12 matches found
pfsense-limiter-number
abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-limiter-number Write-up: https://abraxaslabs.tech/research/pfsense-limiter-number pfsense-limiter-number Class: RCE Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org Traffic Shaper Limiters emit...
CVE-2026-111218
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a...
CVE-2026-111218 Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a...
CVE-2026-111218
Netgate pfSense CE 2.7.0 through 2.9.0 is vulnerable to an OS command injection vulnerability within the Traffic Shaper Limiters . Authenticated users possessing Traffic Shaper Limiters privileges can execute commands as root by tampering with the limiter number field . The flaw occurs because th...
EUVD-2026-102330
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a...
CVE-2026-111218 Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a...
CVE-2026-58395 OPNsense: XPath injection in MVC safe-delete
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through ApiMutableModelControllerBase::delBase interpolates an unvalidated safe-delete token from the request URL into an XPath expression over config.xml before confirming that the...
EUVD-2026-102116
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through ApiMutableModelControllerBase::delBase interpolates an unvalidated safe-delete token from the request URL into an XPath expression over config.xml before confirming that the...
CVE-2026-111218: Improper Neutralization of Special Elements used in an OS Command
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a...
CVE-2026-58395: Improper Neutralization of Data within XPath Expressions
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through ApiMutableModelControllerBase::delBase interpolates an unvalidated safe-delete token from the request URL into an XPath expression over config.xml before confirming that the...
PT-2026-115183
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a...
