Skip to content
OpenAdvisories

Product · Netgate

pfSense Plus

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-56128

    pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.php

    pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_schedule_edit.php. The schedule description is stored without HTML sanitiz…

    Netgate pfSense CE pfSense Plus
  • Medium 5.4
    CVE-2026-56127

    pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.php

    pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_rules_edit.php. The firewall rule description is stored in the pfSense XML con…

    Netgate pfSense CE pfSense Plus
  • Medium 5.4
    CVE-2026-56126

    pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.php

    pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /status_monitoring.php. Multiple POST parameters including graph-left, graph-rig…

    Netgate pfSense CE pfSense Plus
  • Medium 6.1
    CVE-2026-67189

    pfSense Plus/CE Stored XSS via Traffic Graphs PTR Record

    pfSense Plus before 26.07 and pfSense CE through 2.8.1 contain a stored cross-site scripting vulnerability in the Traffic Graphs top-talkers feature, where PTR records returned by reverse DNS lookups are incorporated without sanitization into AJAX responses a…

    Netgate pfSense CE pfSense Plus