CVE-2026-111219

Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in servicespppoeedit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a line whose secret begins with '!', making...

CVE-2026-111221

Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret. Attackers with L2TP or PPPoE Server edit privileges can POST a secret containing a quote and newline to...

CVE-2026-111221

Netgate pfSense CE versions through 2.9.0 are vulnerable to a configuration injection flaw. Authenticated WebGUI users with L2TP or PPPoE Server edit privileges can perform a command injection by submitting an unescaped RADIUS shared secret . By sending a secret containing a quote and newline to ...

CVE-2026-111219

Netgate pfSense CE versions through 2.9.0 are vulnerable to a command injection flaw located in services_pppoe_edit.php. The issue stems from a newline injection vulnerability where the application fails to validate username POST fields . A user with PPPoE Server Edit privileges can inject entrie...