pfSense

With the Kea backend active, when adding or editing a DHCPv6 pool, the services_dhcpv6.php page prints the descriptions (descr field) of existing pools without encoding. A pool with a specially-crafted payload can trigger an XSS:

<img src=x onerror=alert('xss')>

Notes:

• Requires the Kea DHCP server backend, the ISC DHCPv6 backend GUI does not support pools.
• The list on services_dhcpv6.php when viewing the interface configuration is encoded properly, the problematic view is only when adding a new pool or editing an existing pool.