pfSense

The packet_capture.php page uses the values of count and length when executing tcpdump and it doesn't validate that these parameters are the intended type or encode them before use.

The form type is set to 'number' but that client-side validation does not prevent clients from submitting invalid data.

Due to a lack of escaping on commands in the functions being called, it is possible to execute arbitrary commands with a properly formatted submission value for $_POST['count'] or $_POST['length'].