PF
Product
pfSense
50
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 16Medium 13Low 0
Watch
Add pfSense to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-12490 | 8.8 | Nov 6 | Netgate pfSense CE Suricata Path Traversal Remote Code Execution Vulnerability Affected: pfSense 2.8.1, Suricata package 7.0.8_3 |
| CVE-2023-48123 | 8.8 | Dec 6 | An issue in Netgate pfSense Plus v.23.05.1 and before and pfSense CE v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the packet_capture.php… Affected: through 2.7.0 |
| CVE-2023-42326 | 8.8 | Nov 14 | An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfaces_gif_edit.php and interfaces_gre_edit.php components Affected: through 2.7.0 |
| CVE-2023-27253 | 8.8 | Mar 17 | A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via manipulating the… Affected: 2.7.0 |
| CVE-2022-26019 | 8.8 | Mar 31 | Improper access control vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a… Affected: before 2.6.0 |
| CVE-2022-24299 | 8.8 | Mar 31 | Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a… Affected: before 2.6.0 |
| CVE-2019-16667 | 8.8 | Sep 26 | diag_command.php in pfSense 2.4.4-p3 allows CSRF via the txtCommand or txtRecallBuffer field, as demonstrated by executing OS commands Affected: 2.4.4 |
| CVE-2019-16701 | 8.8 | Sep 25 | pfSense through 2.3.4 through 2.4.4-p3 allows Remote Code Injection via a methodCall XML document with a pfsense.exec_php call containing shell metacharacters in a parameter value Affected: 2.3.4 before 2.4.4; 2.4.4; 2.4.4; 2.4.4; 2.4.4 |
| CVE-2018-16055 | 8.8 | Sep 26 | An authenticated command injection vulnerability exists in status_interfaces.php via dhcp_relinquish_lease() in pfSense before 2.4.4 due to its passing user input from the $_POST… Affected: before 2.4.4 |
| CVE-2017-1000479 | 8.8 | Jan 3 | pfSense versions 2.4.1 and lower are vulnerable to clickjacking attacks in the CSRF error page resulting in privileged execution of arbitrary code, because the error detection… Affected: through 2.4.1 |
| CVE-2018-20799 | 7.5 | Mar 1 | In pfSense 2.4.4_1, blocking of source IP addresses on the basis of failed HTTPS authentication is inconsistent with blocking of source IP addresses on the basis of failed SSH… Affected: 2.4.4 |
| CVE-2018-20798 | 7.5 | Mar 1 | The expiretable configuration in pfSense 2.4.4_1 establishes block durations that are incompatible with the block durations implemented by sshguard, which might make it easier for… Affected: 2.4.4 |
| CVE-2019-11816 | 7.2 | May 20 | Incorrect access control in the WebUI in OPNsense before version 19.1.8, and pfsense before 2.4.4-p3 allows remote authenticated users to escalate privileges to administrator via… Affected: through 2.4.4; 2.4.4; 2.4.4 |
| CVE-2018-4021 | 7.2 | Dec 3 | An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request Affected: 2.4.4 |
| CVE-2018-4020 | 7.2 | Dec 3 | An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request Affected: 2.4.4 |
| CVE-2018-4019 | 7.2 | Dec 3 | An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request Affected: 2.4.4 |
Showing 16