CVE-2019-12347

In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description field via an acme_accountkeys_edit.php action. The vulnerability occurs due to input validation errors.

• CWE-79

• http://packetstormsecurity.com/files/153112/pfSense-2.4.4-p3-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• https://ctrsec.io/index.php/2019/05/28/stored-xss-acme-pfsense-2-4-4-p3/Exploit, Patch, Third Party Advisory
• https://github.com/pfsense/FreeBSD-ports/commit/504909564079e540689dbdbed3a579483c614275Patch, Third Party Advisory
• https://redmine.pfsense.org/issues/9554#change-40729Exploit, Vendor Advisory
• https://www.pfsense.org/download/Vendor Advisory
• http://packetstormsecurity.com/files/153112/pfSense-2.4.4-p3-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• https://ctrsec.io/index.php/2019/05/28/stored-xss-acme-pfsense-2-4-4-p3/Exploit, Patch, Third Party Advisory
• https://github.com/pfsense/FreeBSD-ports/commit/504909564079e540689dbdbed3a579483c614275Patch, Third Party Advisory
• https://redmine.pfsense.org/issues/9554#change-40729Exploit, Vendor Advisory
• https://www.pfsense.org/download/Vendor Advisory

Published

May 29, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-12328A command injection (missing input validation) issue in the …9
• CVE-2019-1233A denial of service vulnerability exists in Microsoft Exchan…7.5
• CVE-2019-12331PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The …8.8
• CVE-2019-1234A spoofing vulnerability exists when Azure Stack fails to va…7.5
• CVE-2019-12345XSS exists in the Kiboko Hostel plugin before 1.1.4 for Word…
• CVE-2019-12346In the miniOrange SAML SP Single Sign On plugin before 4.8.7…
• CVE-2019-12348An issue was discovered in zzcms 2019. SQL Injection exists …9.8
• CVE-2019-12349An issue was discovered in zzcms 2019. SQL Injection exists …9.8
• CVE-2019-1235An elevation of privilege vulnerability exists in Windows Te…7.8
• CVE-2019-12350An issue was discovered in zzcms 2019. SQL Injection exists …9.8
• CVE-2019-12351An issue was discovered in zzcms 2019. SQL Injection exists …9.8
• CVE-2019-12352An issue was discovered in zzcms 2019. There is a SQL inject…8.8