Stored Cross-Site Scripting in pfSense by Electric Sheep Fencing
CVE-2025-34174

5.1MEDIUM

Key Information:

Vendor: Netgate
Status: Pfsense Ce
Vendor: CVE Published:; 9 September 2025

What is CVE-2025-34174?

In pfSense, the Traffic Totals page does not properly sanitize the 'start-day' parameter, which can allow an authenticated attacker to inject HTML and JavaScript content. This unsanitized input is saved and displayed to all users visiting the page, creating a vector for stored cross-site scripting attacks. Users with 'WebCfg - Status: Traffic Totals' permissions are particularly at risk, as their interactions could lead to the execution of malicious scripts.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch