An issue discovered in Pfsense CE version 2.6.0 allows attackers to compromise user accounts via weak password requirements.
An issue discovered in Pfsense CE version 2.6.0 allows attackers to change the password of any user without verification.
pfSense CE through 2.6.0 and pfSense Plus before 22.05 allow XSS in the WebGUI via URL Table Alias URL parameters.
Pfsense CE version 2.6.0 is vulnerable to No rate limit which can lead to an attacker creating multiple malicious users in firewall.