https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 11:22:43 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-261425 EUVD-2026-261425 https://cve.radiocsirt.org/vuln/euvd-2026-261425 https://cve.radiocsirt.org/vuln/fkie_cve-2025-34174 <p>In pfSense CE /usr/local/www/status_traffic_totals.php, the value of the start-day parameter is not ensured to be a numeric value or sanitized of HTML-related characters/strings before being directly displayed in the input box. This value can be saved as the default value to be displayed to all users when visiting the Status Traffic Totals page, resulting in stored cross-site scripting. The attacker must be authenticated with at least &#34;WebCfg - Status: Traffic Totals&#34; permissions.</p> <p>In pfSense CE /usr/local/www/status_traffic_totals.php, the value of the start-day parameter is not ensured to be a numeric value or sanitized of HTML-related characters/strings before being directly displayed in the input box. This value can be saved as the default value to be displayed to all users when visiting the Status Traffic Totals page, resulting in stored cross-site scripting. The attacker must be authenticated with at least &#34;WebCfg - Status: Traffic Totals&#34; permissions.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-34174 https://cve.radiocsirt.org/vuln/ghsa-6p4q-ch45-w85q <p>In pfSense CE /usr/local/www/status_traffic_totals.php, the value of the start-day parameter is not ensured to be a numeric value or sanitized of HTML-related characters/strings before being directly displayed in the input box. This value can be saved as the default value to be displayed to all users when visiting the Status Traffic Totals page, resulting in stored cross-site scripting. The attacker must be authenticated with at least &#34;WebCfg - Status: Traffic Totals&#34; permissions.</p> <p>In pfSense CE /usr/local/www/status_traffic_totals.php, the value of the start-day parameter is not ensured to be a numeric value or sanitized of HTML-related characters/strings before being directly displayed in the input box. This value can be saved as the default value to be displayed to all users when visiting the Status Traffic Totals page, resulting in stored cross-site scripting. The attacker must be authenticated with at least &#34;WebCfg - Status: Traffic Totals&#34; permissions.</p> https://cve.radiocsirt.org/vuln/ghsa-6p4q-ch45-w85q https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2016 <p>Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Netgate pfSense ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen und vertrauliche Informationen offenzulegen.</p> <p>Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Netgate pfSense ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen und vertrauliche Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2016