CVE-2022-23993

/usr/local/www/pkg.php in pfSense CE before 2.6.0 and pfSense Plus before 22.01 uses $_REQUEST['pkg_filter'] in a PHP echo call, causing XSS

published January 26, 2022

CVSS
—
EPSS
2%
Percentile
74.5
In the wild
Unconfirmed
What it is

/usr/local/www/pkg.php in pfSense CE before 2.6.0 and pfSense Plus before 22.01 uses $_REQUEST['pkg_filter'] in a PHP echo call, causing XSS.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01528 · 74.5th percentile
Published
2022-01-26T18:22Z
EPSS history
Timeline
  • 26 JAN 18:22Z
    /usr/local/www/pkg.php in pfSense CE before 2.6.0 and pfSense Plus before 22.01 uses $_REQUEST['pkg_filter'] in a PHP echo call, causing XSS
    cvelistv5