pfSense

When adding or editing a DHCPv4 pool, the services_dhcp.php page prints the descriptions (descr field) of existing pools without encoding. A pool with a specially-crafted payload can trigger an XSS:

<img src=x onerror=alert('xss')>

Note that the list on services_dhcp.php when viewing the interface configuration is encoded properly, the problematic view is only when adding a new pool or editing an existing pool.