Vulnerability Details CVE-2025-34172
In pfSense CE /usr/local/www/haproxy/haproxy_stats.php, the value of the showsticktablecontent parameter is displayed after being read from HTTP GET requests. This can enable reflected cross-site scripting when the victim is authenticated.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 28.8%
CVSS Severity
CVSS v3 Score 6.1
References
Products affected by CVE-2025-34172
-
cpe:2.3:a:pfsense:pfsense:-
-
cpe:2.3:a:pfsense:pfsense:2.2.6
-
cpe:2.3:a:pfsense:pfsense:2.4.4
-
cpe:2.3:a:pfsense:pfsense:2.5.2
-
cpe:2.3:a:pfsense:pfsense:2.6.0