彙總 pfsense 相關全部產品的 CVE 與安全漏洞情報，包括 CVSS、EPSS、公開時間與漏洞情報資料。
常見弱點模式包括 跨站腳本、路徑處理缺陷與檔案包含，在 生產負載與軟體部署 使用場景中可能帶來 工作階段劫持、檔案覆寫與未授權存取 等風險。
相關漏洞資料主要來源於公開漏洞披露與安全公告，可用於評估歷史漏洞暴露面與修補優先順序。
| CVE | 摘要 | 來源 | 最高 CVSS | EPSS % | 公開時間 | 更新時間 |
|---|---|---|---|---|---|---|
| CVE-2025-69691 | Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the Supplier disputes this because the API call is only available to admins and they are intentionally allowed to execute PHP code. | [email protected] | 9.9 | 0.53% | 2026-05-08 | 2026-06-17 |
| CVE-2025-69690 | Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the post_reboot_commands property. NOTE: the Supplier disputes this because this installer is only available to admins and they are intentionally allowed to execute PHP code. | [email protected] | 9.1 | 0.63% | 2026-05-08 | 2026-06-17 |
| CVE-2025-34178 | In pfSense CE /suricata/suricata_app_parsers.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed. This can result in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Services: suricata package" permissions. | [email protected] | 5.1 | 3.42% | 2025-09-09 | 2026-06-17 |
| CVE-2025-34177 | In pfSense CE /suricata/suricata_flow_stream.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed. This can result in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Services: suricata package" permissions. | [email protected] | 5.1 | 0.79% | 2025-09-09 | 2026-06-17 |
| CVE-2025-34176 | In pfSense CE /suricata/suricata_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related strings/characters. This value is directly used in a file existence check operation. While the contents of the file cannot be read, the server reveals whether the file exists, which enables an attacker to enumerate files on the target. The attacker must be authenticated with at least "WebCfg - Services: suricata package" permissions. | [email protected] | 5.3 | 14.01% | 2025-09-09 | 2026-06-17 |
| CVE-2025-34175 | In pfSense CE /usr/local/www/suricata/suricata_filecheck.php, the value of the filehash parameter is directly displayed without sanitizing for HTML-related characters/strings. This can result in reflected cross-site scripting if the victim is authenticated. | [email protected] | 5.1 | 14.77% | 2025-09-09 | 2026-06-17 |
| CVE-2025-34174 | In pfSense CE /usr/local/www/status_traffic_totals.php, the value of the start-day parameter is not ensured to be a numeric value or sanitized of HTML-related characters/strings before being directly displayed in the input box. This value can be saved as the default value to be displayed to all users when visiting the Status Traffic Totals page, resulting in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Status: Traffic Totals" permissions. | [email protected] | 5.1 | 9.81% | 2025-09-09 | 2026-06-17 |
| CVE-2025-34173 | In pfSense CE /usr/local/www/snort/snort_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related characters/strings before being used to check if a file exists. While the contents of the file cannot be read, the server reveals whether a file exists, which allows an attacker to enumerate files on the target. The attacker must be authenticated with at least "WebCfg - Services: Snort package" permissions. | [email protected] | 5.3 | 0.84% | 2025-09-09 | 2026-06-17 |
| CVE-2025-34172 | In pfSense CE /usr/local/www/haproxy/haproxy_stats.php, the value of the showsticktablecontent parameter is displayed after being read from HTTP GET requests. This can enable reflected cross-site scripting when the victim is authenticated. | [email protected] | 4.8 | 0.96% | 2025-09-09 | 2026-06-17 |
| CVE-2025-53392 | In Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading arbitrary files via diag_command.php dlPath directory traversal. NOTE: the Supplier's perspective is that this is intended behavior for this privilege level, and that system administrators are informed through both the product documentation and UI. | [email protected] | 5.0 | 1.77% | 2025-06-28 | 2026-06-17 |
| CVE-2023-29975 | An issue discovered in Pfsense CE version 2.6.0 allows attackers to change the password of any user without verification. | [email protected] | 7.2 | 1.68% | 2023-11-09 | 2026-06-17 |
| CVE-2023-29974 | An issue discovered in Pfsense CE version 2.6.0 allows attackers to compromise user accounts via weak password requirements. | [email protected] | 9.8 | 1.75% | 2023-11-08 | 2026-06-17 |
| CVE-2023-29973 | Pfsense CE version 2.6.0 is vulnerable to No rate limit which can lead to an attacker creating multiple malicious users in firewall. | [email protected] | 4.9 | 1.63% | 2023-10-25 | 2026-06-17 |
| CVE-2020-19678 | Directory Traversal vulnerability found in Pfsense v.2.1.3 and Pfsense Suricata v.1.4.6 pkg v.1.0.1 allows a remote attacker to obtain sensitive information via the file parameter to suricata/suricata_logs_browser.php. | [email protected] | 7.5 | 3.47% | 2023-04-06 | 2026-06-16 |
| CVE-2023-27100 | Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to bypass brute force protection mechanisms via crafted web requests. | [email protected] | 9.8 | 9.84% | 2023-03-22 | 2026-06-17 |
| CVE-2022-40624 | pfSense pfBlockerNG through 2.1.4_27 allows remote attackers to execute arbitrary OS commands as root via the HTTP Host header, a different vulnerability than CVE-2022-31814. | [email protected] | 9.8 | 17.11% | 2022-12-20 | 2026-06-17 |
| CVE-2022-42247 | pfSense v2.5.2 was discovered to contain a cross-site scripting (XSS) vulnerability in the browser.php component. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into a file name. | [email protected] | 6.1 | 2.45% | 2022-10-03 | 2026-06-17 |
| CVE-2021-20729 | Cross-site scripting vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions 2.5.2 and earlier, and pfSense Plus software versions 21.05 and earlier) allows a remote attacker to inject an arbitrary script via a malicious URL. | [email protected] | 6.1 | 2.77% | 2022-03-31 | 2026-06-16 |
| CVE-2022-21132 | Directory traversal vulnerability in pfSense-pkg-WireGuard pfSense-pkg-WireGuard 0.1.5 versions prior to 0.1.5_4 and pfSense-pkg-WireGuard 0.1.6 versions prior to 0.1.6_1 allows a remote authenticated attacker to lead a pfSense user to view a file outside the public folder. | [email protected] | 6.5 | 1.71% | 2022-03-10 | 2026-06-17 |
| CVE-2021-41282 | diag_routes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data about the routes set in the firewall. The data is retrieved by executing the netstat utility, and then its output is parsed via the sed utility. Although the common protection mechanisms against command injection (i.e., the usage of the escapeshellarg function for the arguments) are used, it is still possible to inject sed-specific code and write an arbitrary file in an arbitrary | [email protected] | 8.8 | 87.11% | 2022-03-01 | 2026-06-17 |