EUVD-2026-70498

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewallscheduleedit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an...

CVE-2026-56128

pfSense Plus before 26.07 and pfSense CE before 2.9.0 contain a stored cross-site scripting vulnerability in the firewall schedule editor. Authenticated users with the Firewall: Schedules: Edit privilege can inject arbitrary JavaScript via the descr parameter in /firewall_schedule_edit.php. The v...

FortiOS Web Interface XSS

The vulnerability in the FortiOS operating system’s web interface firewall/schedule/recurrdlg is due to insufficient protection of the web page structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary JavaScript or HTML code through the mkey parameter...

CVE-2014-4687

Multiple cross-site scripting XSS vulnerabilities in pfSense before 2.1.4 allow remote attackers to inject arbitrary web script or HTML via 1 the starttime0 parameter to firewallschedule.php, 2 the rssfeed parameter to rss.widget.php, 3 the servicestatusfilter parameter to...

PT-2014-2006

Name of the Vulnerable Software and Affected Versions FortiOS versions 5.0.5 Description The issue is caused by insufficient protection of the web page structure in the FortiOS operating system, specifically in the firewall/schedule/recurrdlg component. This allows a remote attacker to inject...

CVE-2013-7182: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in firewall/schedule/recurrdlg in Fortinet FortiOS 5.0.5 allows remote attackers to inject arbitrary web script or HTML via the mkey parameter...