GCVE - cpe:2.3:a:pfsense:pfsense:2.5.2:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:pfsense:pfsense:2.5.2:*:*:*:*:*:*:*

part: a version: 2.5.2 update: *

Vendor	Pfsense (`16119953-645e-5c83-888a-eeb9b3a567ca`)
Product	Pfsense (`9a2d153d-225b-5e7e-b5c7-b1e06bfbde2d`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/pfsense/pfsense`	purl2cpe	2026-06-01 10:14:57.732263

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-46538`	vulnerable	2026-06-08 06:48:10.140696	Details available A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $pconfig variable at interfaces_groups_edit.php. Published: 2024-10-22T00:00:00.000Z Updated: 2024-10-22T18:51:47.447Z Open on db.gcve.eu Reference links https://github.com/physicszq/web_issue/blob/main/pfsense/interfaces_groups_edit_file.md_xss.md https://redmine.pfsense.org/issues/15778	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-42247`	vulnerable	2026-06-08 05:49:29.602323	Details available pfSense v2.5.2 was discovered to contain a cross-site scripting (XSS) vulnerability in the browser.php component. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into a file name. Published: 2022-10-03T15:31:48.000Z Updated: 2024-08-03T13:03:45.586Z Open on db.gcve.eu Reference links https://gist.github.com/enferas/b4ca7a4fb52e1b5e698f87e4d655a70a https://github.com/pfsense/pfsense/commit/73ca6743954ac9f35ca293e3f2af63eac20cf32e	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-41282`	vulnerable	2026-06-08 05:35:20.114640	Details available diag_routes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data about the routes set in the firewall. The data is retrieved by executing the netstat utility, and then its output is parsed via the sed utility. Although the common protection mechanisms against command injection (i.e., the usage of the escapeshellarg function for the arguments) are used, it is still possible to inject sed-specific code and write an arbitrary file in an arbitrary location. Published: 2022-03-01T22:45:03.000Z Updated: 2024-08-04T03:08:31.835Z Open on db.gcve.eu Reference links https://www.shielder.it/advisories/ https://www.shielder.it/advisories/pfsense-remote-command-execution/ https://docs.netgate.com/pfsense/en/latest/releases/22-01_2-6-0.html http://packetstormsecurity.com/files/166208/pfSense-2.5.2-Shell-Upload.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.