CVE-2020-19203: Netgate Pfsense

Medium severity, CVSS 5.4. EPSS: 1.1% chance of exploitation in the next 30 days.

An authenticated Cross-Site Scripting (XSS) vulnerability was found in widgets/widgets/wake_on_lan_widget.php, a component of the pfSense software WebGUI, on version 2.4.4-p2 and earlier. The widget did not encode the descr (description) parameter of wake-on-LAN entries in its output, leading to a possible stored XSS.

Affected products

• Netgate Pfsense: before 2.4.4 (fixed in 2.4.4); version 2.4.4 only

Published 2021-07-12. Last modified 2026-06-17.