Netgate Pfsense
51 CVEs affecting Netgate Pfsense. Latest disclosed: 2025-11-06. Critical: 3, High: 16.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-16915 | Critical | 9.8 | 2019-09-26 | An issue was discovered in pfSense through 2.4.4-p3. widgets/widgets/picture.widget.php uses the widgetkey parameter directly without sanitization (e.g., a bas… |
CVE-2019-12585 | Critical | 9.8 | 2019-06-03 | Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an Arbitrary Command Execution issue in apcupsd_status.php. |
CVE-2020-21487 | Critical | 9.6 | 2023-04-04 | Cross Site Scripting vulnerability found in Netgate pfSense 2.4.4 and ACME package v.0.6.3 allows attackers to execute arbitrary code via the RootFolder field… |
CVE-2025-12490 | High | 8.8 | 2025-11-06 | Netgate pfSense CE Suricata Path Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affecte… |
CVE-2023-48123 | High | 8.8 | 2023-12-06 | An issue in Netgate pfSense Plus v.23.05.1 and before and pfSense CE v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the pa… |
CVE-2023-42326 | High | 8.8 | 2023-11-14 | An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfaces_gif_edit.php and interfaces_gre_… |
CVE-2023-27253 | High | 8.8 | 2023-03-17 | A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via… |
CVE-2022-26019 | High | 8.8 | 2022-03-31 | Improper access control vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 2… |
CVE-2022-24299 | High | 8.8 | 2022-03-31 | Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to… |
CVE-2019-16667 | High | 8.8 | 2019-09-26 | diag_command.php in pfSense 2.4.4-p3 allows CSRF via the txtCommand or txtRecallBuffer field, as demonstrated by executing OS commands. This occurs because csr… |
CVE-2019-16701 | High | 8.8 | 2019-09-25 | pfSense through 2.3.4 through 2.4.4-p3 allows Remote Code Injection via a methodCall XML document with a pfsense.exec_php call containing shell metacharacters… |
CVE-2018-16055 | High | 8.8 | 2018-09-26 | An authenticated command injection vulnerability exists in status_interfaces.php via dhcp_relinquish_lease() in pfSense before 2.4.4 due to its passing user in… |
CVE-2017-1000479 | High | 8.8 | 2018-01-03 | pfSense versions 2.4.1 and lower are vulnerable to clickjacking attacks in the CSRF error page resulting in privileged execution of arbitrary code, because the… |
CVE-2018-20799 | High | 7.5 | 2019-03-01 | In pfSense 2.4.4_1, blocking of source IP addresses on the basis of failed HTTPS authentication is inconsistent with blocking of source IP addresses on the bas… |
CVE-2018-20798 | High | 7.5 | 2019-03-01 | The expiretable configuration in pfSense 2.4.4_1 establishes block durations that are incompatible with the block durations implemented by sshguard, which migh… |
CVE-2019-11816 | High | 7.2 | 2019-05-20 | Incorrect access control in the WebUI in OPNsense before version 19.1.8, and pfsense before 2.4.4-p3 allows remote authenticated users to escalate privileges t… |
CVE-2018-4021 | High | 7.2 | 2018-12-03 | An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The atta… |
CVE-2018-4020 | High | 7.2 | 2018-12-03 | An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The atta… |
CVE-2018-4019 | High | 7.2 | 2018-12-03 | An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. The atta… |
CVE-2022-29273 | Medium | 6.1 | 2023-02-22 | pfSense CE through 2.6.0 and pfSense Plus before 22.05 allow XSS in the WebGUI via URL Table Alias URL parameters. |