汇总 pfsense 相关全部产品的 CVE 与安全漏洞情报，包括 CVSS、EPSS、公开时间与漏洞情报数据。
常见弱点模式包括 跨站脚本、路径处理缺陷与文件包含，在 生产负载与软件部署 使用场景中可能带来 会话劫持、文件覆盖与未授权访问 等风险。
相关漏洞数据主要来源于公开漏洞披露与安全公告，可用于评估历史漏洞暴露面与修复优先级。
| CVE | 摘要 | 来源 | 最高 CVSS | EPSS % | 公开时间 | 更新时间 |
|---|---|---|---|---|---|---|
| CVE-2025-69691 | Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the Supplier disputes this because the API call is only available to admins and they are intentionally allowed to execute PHP code. | [email protected] | 9.9 | 0.53% | 2026-05-08 | 2026-06-17 |
| CVE-2025-69690 | Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the post_reboot_commands property. NOTE: the Supplier disputes this because this installer is only available to admins and they are intentionally allowed to execute PHP code. | [email protected] | 9.1 | 0.63% | 2026-05-08 | 2026-06-17 |
| CVE-2025-34178 | In pfSense CE /suricata/suricata_app_parsers.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed. This can result in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Services: suricata package" permissions. | [email protected] | 5.1 | 3.42% | 2025-09-09 | 2026-07-14 |
| CVE-2025-34177 | In pfSense CE /suricata/suricata_flow_stream.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed. This can result in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Services: suricata package" permissions. | [email protected] | 5.1 | 0.79% | 2025-09-09 | 2026-07-14 |
| CVE-2025-34176 | In pfSense CE /suricata/suricata_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related strings/characters. This value is directly used in a file existence check operation. While the contents of the file cannot be read, the server reveals whether the file exists, which enables an attacker to enumerate files on the target. The attacker must be authenticated with at least "WebCfg - Services: suricata package" permissions. | [email protected] | 5.3 | 13.90% | 2025-09-09 | 2026-07-14 |
| CVE-2025-34175 | In pfSense CE /usr/local/www/suricata/suricata_filecheck.php, the value of the filehash parameter is directly displayed without sanitizing for HTML-related characters/strings. This can result in reflected cross-site scripting if the victim is authenticated. | [email protected] | 5.1 | 14.77% | 2025-09-09 | 2026-07-14 |
| CVE-2025-34174 | In pfSense CE /usr/local/www/status_traffic_totals.php, the value of the start-day parameter is not ensured to be a numeric value or sanitized of HTML-related characters/strings before being directly displayed in the input box. This value can be saved as the default value to be displayed to all users when visiting the Status Traffic Totals page, resulting in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Status: Traffic Totals" permissions. | [email protected] | 5.1 | 9.81% | 2025-09-09 | 2026-06-17 |
| CVE-2025-34173 | In pfSense CE /usr/local/www/snort/snort_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related characters/strings before being used to check if a file exists. While the contents of the file cannot be read, the server reveals whether a file exists, which allows an attacker to enumerate files on the target. The attacker must be authenticated with at least "WebCfg - Services: Snort package" permissions. | [email protected] | 5.3 | 0.84% | 2025-09-09 | 2026-07-14 |
| CVE-2025-34172 | In pfSense CE /usr/local/www/haproxy/haproxy_stats.php, the value of the showsticktablecontent parameter is displayed after being read from HTTP GET requests. This can enable reflected cross-site scripting when the victim is authenticated. | [email protected] | 4.8 | 0.96% | 2025-09-09 | 2026-07-14 |
| CVE-2025-53392 | In Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading arbitrary files via diag_command.php dlPath directory traversal. NOTE: the Supplier's perspective is that this is intended behavior for this privilege level, and that system administrators are informed through both the product documentation and UI. | [email protected] | 5.0 | 1.77% | 2025-06-28 | 2026-06-17 |
| CVE-2023-29975 | An issue discovered in Pfsense CE version 2.6.0 allows attackers to change the password of any user without verification. | [email protected] | 7.2 | 1.68% | 2023-11-09 | 2026-06-17 |
| CVE-2023-29974 | An issue discovered in Pfsense CE version 2.6.0 allows attackers to compromise user accounts via weak password requirements. | [email protected] | 9.8 | 1.75% | 2023-11-08 | 2026-06-17 |
| CVE-2023-29973 | Pfsense CE version 2.6.0 is vulnerable to No rate limit which can lead to an attacker creating multiple malicious users in firewall. | [email protected] | 4.9 | 1.63% | 2023-10-25 | 2026-06-17 |
| CVE-2020-19678 | Directory Traversal vulnerability found in Pfsense v.2.1.3 and Pfsense Suricata v.1.4.6 pkg v.1.0.1 allows a remote attacker to obtain sensitive information via the file parameter to suricata/suricata_logs_browser.php. | [email protected] | 7.5 | 3.47% | 2023-04-06 | 2026-06-16 |
| CVE-2023-27100 | Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to bypass brute force protection mechanisms via crafted web requests. | [email protected] | 9.8 | 9.84% | 2023-03-22 | 2026-06-17 |
| CVE-2022-40624 | pfSense pfBlockerNG through 2.1.4_27 allows remote attackers to execute arbitrary OS commands as root via the HTTP Host header, a different vulnerability than CVE-2022-31814. | [email protected] | 9.8 | 17.11% | 2022-12-20 | 2026-06-17 |
| CVE-2022-42247 | pfSense v2.5.2 was discovered to contain a cross-site scripting (XSS) vulnerability in the browser.php component. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into a file name. | [email protected] | 6.1 | 2.45% | 2022-10-03 | 2026-06-17 |
| CVE-2021-20729 | Cross-site scripting vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions 2.5.2 and earlier, and pfSense Plus software versions 21.05 and earlier) allows a remote attacker to inject an arbitrary script via a malicious URL. | [email protected] | 6.1 | 2.77% | 2022-03-31 | 2026-06-16 |
| CVE-2022-21132 | Directory traversal vulnerability in pfSense-pkg-WireGuard pfSense-pkg-WireGuard 0.1.5 versions prior to 0.1.5_4 and pfSense-pkg-WireGuard 0.1.6 versions prior to 0.1.6_1 allows a remote authenticated attacker to lead a pfSense user to view a file outside the public folder. | [email protected] | 6.5 | 1.76% | 2022-03-10 | 2026-06-17 |
| CVE-2021-41282 | diag_routes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data about the routes set in the firewall. The data is retrieved by executing the netstat utility, and then its output is parsed via the sed utility. Although the common protection mechanisms against command injection (i.e., the usage of the escapeshellarg function for the arguments) are used, it is still possible to inject sed-specific code and write an arbitrary file in an arbitrary | [email protected] | 8.8 | 87.11% | 2022-03-01 | 2026-06-17 |