CVE-2020-19203

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

An authenticated Cross-Site Scripting (XSS) vulnerability was found in widgets/widgets/wake_on_lan_widget.php, a component of the pfSense software WebGUI, on version 2.4.4-p2 and earlier. The widget did not encode the descr (description) parameter of wake-on-LAN entries in its output, leading to a possible stored XSS.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://docs.netgate.com/pfsense/en/latest/releases/2-4-4-p3.htmlVendor Advisory
https://gist.github.com/dharmeshbaskaran/55d546496bfb0ba28117e846d8b785dbThird Party Advisory
https://www.netgate.com/assets/downloads/advisories/pfSense-SA-19_04.webgui.ascVendor Advisory
https://www.pfsense.org/download/Product, Release Notes, Vendor Advisory
https://docs.netgate.com/pfsense/en/latest/releases/2-4-4-p3.htmlVendor Advisory
https://gist.github.com/dharmeshbaskaran/55d546496bfb0ba28117e846d8b785dbThird Party Advisory
https://www.netgate.com/assets/downloads/advisories/pfSense-SA-19_04.webgui.ascVendor Advisory
https://www.pfsense.org/download/Product, Release Notes, Vendor Advisory

Timeline

Published: Jul 12, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-192045.4An authenticated Stored Cross-Site Scriptiong (XSS) vulnerability exists in Lightning Wire Labs IPFire 2.21 (x86_64) - Core Update 130 in th CVE-2020-19217.5In the crypt function, we attempt to null terminate a buffer using the size of the input salt without validating that the offset is within t CVE-2020-192124.9SQL Injection vulnerability in admin/group_list.php in piwigo v2.9.5, via the group parameter to delete.CVE-2020-192139.8SQL Injection vulnerability in cat_move.php in piwigo v2.9.5, via the selection parameter to move_categories.CVE-2020-192158.8SQL Injection vulnerability in admin/user_perm.php in piwigo v2.9.5, via the cat_false parameter to admin.php?page=user_perm.CVE-2020-192168.8SQL Injection vulnerability in admin/user_perm.php in piwigo v2.9.5, via the cat_false parameter to admin.php?page=group_perm.CVE-2020-192178.8SQL Injection vulnerability in admin/batch_manager.php in piwigo v2.9.5, via the filter_category parameter to admin.php?page=batch_manager.CVE-2020-192287.2An issue was found in bludit v3.13.0, unsafe implementation of the backup plugin allows attackers to upload arbitrary files.CVE-2020-192299.8Jeesite 1.2.7 uses the apache shiro version 1.2.3 affected by CVE-2016-4437. Because of this version of the java deserialization vulnerabili CVE-2020-192485.1SQL Injection vulnerability in PbootCMS 1.4.1 in parsing if statements in templates, resulting in a malicious user's ability to contaminate CVE-2020-19257.5Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperImpl class which reads a URL from the Location header, and then sends a CVE-2020-19265.9Apache Hive cookie signature verification used a non constant time comparison which is known to be vulnerable to timing attacks. This could