CVE-2024-46538

Medium

A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted…

mitre·CWE-79·Published 2024-10-22

CVSS

4.8

EPSS

0.78

KEV

Exploits

cve.orgen

207 chars

A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $pconfig variable at interfaces_groups_edit.php.

NVDen

207 chars

NVDes

231 chars

Una vulnerabilidad de cross-site scripting (XSS) en pfsense v2.5.2 permite a los atacantes ejecutar scripts web o HTML arbitrarios a través de un payload manipulado e inyectado en la variable $pconfig en interfaces_groups_edit.php.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
3.1	Primary	cve.org	9.3	—	—	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
3.1	Primary	NVD	4.8	1.7	2.7	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N