pfsense-unbound-acl-crlf

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-unbound-acl-crlf pfsense-unbound-acl-crlf Class: RCE Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org ACL name/action go into accesslists.conf with no checkconf. Same include: class as...

pfsense-logs-filter-xss

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-logs-filter-xss pfsense-logs-filter-xss Class: XSS Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org statuslogsfilter.php POST resolve= jsonencode with no JSONHEXTAG and default Content-Type...

cve-2025-50428

CVE-2025-50428 - RaspAP Command Injection A proof-of-concept exploit for CVE-2025-50428, a command injection vulnerability in RaspAP raspap-webgui 3.2.9 and earlier. Vulnerability ID| CVE-2025-50428 ---|--- Severity| High CVSS 3.1: 8.6 CVSS Vector|...

pfsense-carp-vhid

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-carp-vhid pfsense-carp-vhid Class: RCE Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org Virtual IP edit stores CARP VHID from POST with no 1-255 check. FormSelect options are HTML only. CARP...

opnsense-lockout-factory-ip

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · opnsense-lockout-factory-ip opnsense-lockout-factory-ip Class: Privilege leftover Reach: Remote OPNsense core 26.7.6 a842fe48 - opnsense.org Unauth WebGUI login still drives lockouthandler from a factory LOGAUTH line...

opnsense-uidfield-system-uid0

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · opnsense-uidfield-system-uid0 opnsense-uidfield-system-uid0 Class: Privilege leftover Reach: Remote OPNsense core 26.7.6 a842fe48 - opnsense.org Delegated page-system-usermanager two-steps scope=system then uid=0...

pfsense-cp-maxprocperip

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-cp-maxprocperip pfsense-cp-maxprocperip Class: Config injection Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org Integer check is on unused POST maxproc. maxprocperip is stored raw and emitted ...

pfsense-igmp-type

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-igmp-type pfsense-igmp-type Class: Config injection Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org servicesigmpproxyedit.php stores POST type with no enum check. configure interpolates phyint...

pfsense-qinq-parent-if

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-qinq-parent-if pfsense-qinq-parent-if Class: RCE Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org QinQ edit stores a parent interface name with no doesinterfaceexist check. VLAN edit already...

pfsense-crash-reporter-xss

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-crash-reporter-xss pfsense-crash-reporter-xss Class: XSS Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org /tmp/PHPerrors.log goes through htmlspecialchars. /var/crash/ is filegetcontents into...

opnsense-wlan-wpa-line

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · opnsense-wlan-wpa-line opnsense-wlan-wpa-line Class: Config line injection Reach: Remote OPNsense core 26.7.6 a842fe48 - opnsense.org Leftover of GHSA-fq94. Wireless SSID got AllowNewlines=N. identity, passphrase, and...

pfsense-dyndns-cache-path

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-dyndns-cache-path pfsense-dyndns-cache-path Class: File write Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org Custom host skips isdomain. updatedns builds the cache path as /conf/dyndnsiftype...

pfsense-gw-ipv6-zone

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-gw-ipv6-zone pfsense-gw-ipv6-zone Class: RCE Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org isipaddrv6 strips %zone for NetIPv6::checkIPv6 and never charset-checks the zone. startdpinger...

pfsense-rss-body-xss

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-rss-body-xss pfsense-rss-body-xss Class: XSS Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org 2604 encodes the title. Body is striptags only. Permalink is raw href. | ---|--- ID| no CVE yet...

pfsense-acb-restore-priv

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-acb-restore-priv pfsense-acb-restore-priv Class: Privilege leftover Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org newver downloads, decrypts with the stored ACB password, configrestore...

pfsense-ovpn-learn-cn

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-ovpn-learn-cn pfsense-ovpn-learn-cn Class: RCE Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org openvpn.learn-address.sh interpolates CN into su -m unbound -c "... localdata $CN.$DOMAIN ..."...

pfsense-cp-filemanager-write

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-cp-filemanager-write pfsense-cp-filemanager-write Class: File write Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org Upload name is not basename. A name that already contains captiveportal- ski...

pfsense-ntp-gps-fudge

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-ntp-gps-fudge pfsense-ntp-gps-fudge Class: Config injection Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org system.inc concatenates GPS/PPS fudge/refid/stratum into ntpd.conf. mwexec is ntpd -...

pfsense-rules-if-xss

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-rules-if-xss pfsense-rules-if-xss Class: XSS Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org firewallrules.php GET if= interpolates into value="" and iface = "" when requirefirewallinterface i...

pfsense-sshguard-crlf

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-sshguard-crlf pfsense-sshguard-crlf Class: RCE Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org sshguardthreshold / blocktime / detectiontime are not isnumericint. systemsshguardstart writes...