Netgate

Authenticated users with QinQ edit privileges can leverage an OS command injection vulnerability in Netgate pfSense CE 2.7.0 through 2.9.0 to execute arbitrary commands as root.

A vulnerability in Netgate pfSense allows a remote, authenticated attacker to execute arbitrary code with administrator privileges.

An authenticated remote attacker can exploit a vulnerability in Netgate pfSense to bypass security controls and execute arbitrary PHP code and shell commands.

Multiple vulnerabilities in Netgate pfSense Plus and CE allow remote attackers to execute arbitrary code or conduct cross-site scripting attacks, posing a high risk to network perimeter security.

A cross-site scripting (XSS) vulnerability affects Netgate pfSense CE (<= 2.8.1) and pfSense Plus (<= 26.03), potentially allowing attackers to inject malicious code.