CVE-2020-10797: Netgate Pfsense

Medium severity, CVSS 6.1. EPSS: 2.4% chance of exploitation in the next 30 days.

An XSS vulnerability resides in the hostname field of the diag_ping.php page in pfsense before 2.4.5 version. After passing inputs to the command and executing this command, the $result variable is not sanitized before it is printed.

Affected products

• Netgate Pfsense: before 2.4.5 (fixed in 2.4.5)

Published 2020-04-29. Last modified 2026-06-17.