7 matches found
CVE-2026-111229
Rejected reason: This CVE ID has been rejected because it does not describe a security vulnerability...
CVE-2026-111229
...
EUVD-2026-102341
pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in servicescaptiveportalhasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connectedusers with shell...
CVE-2026-111229
pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in servicescaptiveportalhasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connectedusers with shell...
CVE-2026-111229
pfSense CE versions 2.7.0 through 2.9.0 are vulnerable to a command injection flaw in services_captiveportal_hasync.php. An attacker with Captive Portal HA privileges can set backwardsyncip to a malicious XMLRPC server. This server can return connected_users data containing shell metacharacters i...
CVE-2026-111229: Improper Neutralization of Special Elements used in an OS Command
pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in servicescaptiveportalhasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connectedusers with shell...