GCVE - cpe:2.3:a:netgate:pfsense:2.4.4:-:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:netgate:pfsense:2.4.4:-:*:*:*:*:*:*

part: a version: 2.4.4 update: -

Vendor	Netgate (`42bc912c-274f-5f68-8e52-e5d60c7dbf39`)
Product	Pfsense (`5aa539db-9816-5834-bdbc-2e98c3f36341`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/pfsense/pfsense`	purl2cpe	2026-06-01 10:11:51.848445

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2020-21487`	vulnerable	2026-06-03 14:42:04.950310	Details available Cross Site Scripting vulnerability found in Netgate pfSense 2.4.4 and ACME package v.0.6.3 allows attackers to execute arbitrary code via the RootFolder field of acme_certificates.php. Published: 2023-04-04T00:00:00.000Z Updated: 2025-02-13T16:36:13.194Z Open on db.gcve.eu Reference links https://github.com/pfsense/FreeBSD-ports/commit/a6f443cde51e7fcf17e51f16014d3589253284d8 https://redmine.pfsense.org/issues/9888	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-19203`	vulnerable	2026-06-03 14:41:54.717783	Details available An authenticated Cross-Site Scripting (XSS) vulnerability was found in widgets/widgets/wake_on_lan_widget.php, a component of the pfSense software WebGUI, on version 2.4.4-p2 and earlier. The widget did not encode the descr (description) parameter of wake-on-LAN entries in its output, leading to a possible stored XSS. Published: 2021-07-12T15:39:07.000Z Updated: 2024-08-04T14:08:30.664Z Open on db.gcve.eu Reference links https://www.pfsense.org/download/ https://docs.netgate.com/pfsense/en/latest/releases/2-4-4-p3.html https://gist.github.com/dharmeshbaskaran/55d546496bfb0ba28117e846d8b785db https://www.netgate.com/assets/downloads/advisories/pfSense-SA-19_04.webgui.asc	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-16915`	vulnerable	2026-06-03 14:39:55.532525	Details available An issue was discovered in pfSense through 2.4.4-p3. widgets/widgets/picture.widget.php uses the widgetkey parameter directly without sanitization (e.g., a basename call) for a pathname to file_get_contents or file_put_contents. Published: 2019-09-26T17:38:42.000Z Updated: 2024-08-05T01:24:48.530Z Open on db.gcve.eu Reference links https://redmine.pfsense.org/issues/9610 https://github.com/pfsense/pfsense/commit/2c544ac61ce98f716d50b8e5961d7dfba66804b5 https://www.seebug.org/vuldb/ssvid-98024	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-16914`	vulnerable	2026-06-03 14:39:55.532062	Details available An XSS issue was discovered in pfSense through 2.4.4-p3. In services_captiveportal_mac.php, the username and delmac parameters are displayed without sanitization. Published: 2019-09-26T17:38:53.000Z Updated: 2024-08-05T01:24:48.605Z Open on db.gcve.eu Reference links https://redmine.pfsense.org/issues/9609 https://github.com/pfsense/pfsense/commit/d31362b69d5d52dc196dc72f66e830cd1e6e9a4f https://www.seebug.org/vuldb/ssvid-98023	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-16701`	vulnerable	2026-06-03 14:39:55.246262	Details available pfSense through 2.3.4 through 2.4.4-p3 allows Remote Code Injection via a methodCall XML document with a pfsense.exec_php call containing shell metacharacters in a parameter value. Published: 2019-09-25T15:45:56.000Z Updated: 2024-08-05T01:17:41.164Z Open on db.gcve.eu Reference links https://github.com/pfsense/pfsense/commits/master http://packetstormsecurity.com/files/154587/pfSense-2.3.4-2.4.4-p3-Remote-Code-Injection.html https://hackernews.blog/pfsense-2-3-4-2-4-4-p3-remote-code-injection/#more	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-12585`	vulnerable	2026-06-03 14:39:35.079966	Details available Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an Arbitrary Command Execution issue in apcupsd_status.php. Published: 2019-06-03T02:28:08.000Z Updated: 2024-08-04T23:24:38.689Z Open on db.gcve.eu Reference links https://github.com/pfsense/FreeBSD-ports/commit/b492c0ea47aba8dde2f14183e71498ba207594e3 https://redmine.pfsense.org/issues/9556 https://ctrsec.io/index.php/2019/05/28/cve-2019-12584-12585-command-injection-vulnerability-on-pfsense-2-4-4-release-p3/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-12584`	vulnerable	2026-06-03 14:39:35.079409	Details available Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an XSS issue in apcupsd_status.php. Published: 2019-06-03T02:27:47.000Z Updated: 2024-08-04T23:24:39.165Z Open on db.gcve.eu Reference links https://github.com/pfsense/FreeBSD-ports/commit/b492c0ea47aba8dde2f14183e71498ba207594e3 https://redmine.pfsense.org/issues/9556 https://ctrsec.io/index.php/2019/05/28/cve-2019-12584-12585-command-injection-vulnerability-on-pfsense-2-4-4-release-p3/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.