PT-2026-85053

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall schedule edit.php. The schedule description is stored without HTML sanitization and subsequently inserted into a...