Exploit for Cross-site Scripting in Netgate Pfsense

Thanks to physicszqhttps://github.com/physicszq/webissue/b...

CVE-2024-46538

A cross-site scripting XSS vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $pconfig variable at interfacesgroupsedit.php...

CVE-2024-46538

A cross-site scripting XSS vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $pconfig variable at interfacesgroupsedit.php...

CVE-2024-46538

PfSense 2.5.2 is affected by CVE-2024-46538: a stored XSS in interfaces_groups_edit.php arises from lack of filtering in the $pconfig variable, enabling injection of scripts. The vulnerability can lead to arbitrary command execution by leveraging diag_command.php, with PoCs available; exploitatio...