Path traversal

Absolute path traversal vulnerability in pkgedit.php in pfSense before 2.1.4 allows remote attackers to read arbitrary XML files via a full pathname in the xml parameter...

CVE-2014-4689

Absolute path traversal vulnerability in pkgedit.php in pfSense before 2.1.4 allows remote attackers to read arbitrary XML files via a full pathname in the xml parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in pfSense 2 beta 4 allow remote attackers to inject arbitrary web script or HTML via 1 the id parameter in an olsrd.xml action to pkgedit.php, 2 the xml parameter to pkg.php, or the if parameter to 3 statusgraph.php or 4 interfaces.php, a differe...

pfSense Cross Site Scripting

"Those who cannot learn from history are doomed to repeat it." - George Santayana http://cvstrac.pfsense.org/chngview?cn=20994 "Comment: Make scripts XSS input safe. " Date: 2008-Feb-11 23:33:24 local 2008-Feb-12 04:33:24 UTC So in 2010, pfsense 2 beta 4: ... xss - pkgedit.php...