CVE-2025-34172: Netgate pfSense CE HAProxy Package 0.63_10 Reflected Cross-Site Scripting
In pfSense CE /usr/local/www/haproxy/haproxy_stats.php, the value of the showsticktablecontent parameter is displayed after being read from HTTP GET requests. This can enable reflected cross-site scripting when the victim is authenticated.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34172?
CVE-2025-34172 has a severity rating that indicates a potential risk for reflected cross-site scripting in authenticated users.
How do I fix CVE-2025-34172?
To mitigate CVE-2025-34172, ensure you update to the latest version of the pfSense CE HAProxy Package where the vulnerability is addressed.
Who is affected by CVE-2025-34172?
CVE-2025-34172 affects users of the pfSense CE HAProxy Package who authenticate to the system.
What type of vulnerability is CVE-2025-34172?
CVE-2025-34172 is categorized as a reflected cross-site scripting vulnerability.
Is CVE-2025-34172 likely to be exploited?
Given that CVE-2025-34172 targets authenticated users, it has the potential to be exploited if proper mitigations are not applied.