Threats affecting pkg:github/skraft9/pfsense-security-research/pfsense

2 threats

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	5.0	EPSS 1.8%	CVE-2025-53392Netgate pfSense · Absolute Path Traversal Medium5.0EPSS 1.8%2025-06-28CVE Database V5CVE-2025-53392 In Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading arbitrary files via diag_command.php dlPath directory traversal. NOTE: the Supplier's perspective is that this is intended behavior for this privilege level, and that system administrators are informed through both the product documentation and UI. EPSS 1.8%Vulnerability CWE-36	CVE Database V5	2025-06-28
Critical	9.3	EPSS 80%	CVE-2024-46538pfsense · A Cross-site Scripting (XSS) Critical9.3EPSS 80%2024-10-22CVE Database V5CVE-2024-46538 A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $pconfig variable at interfaces_groups_edit.php. EPSS 80%Vulnerability CWE-79	CVE Database V5	2024-10-22

Page 1 of 1