Vulnerabilities > Fusionpbx

DATE CVE VULNERABILITY TITLE RISK
2019-10-21 CVE-2019-16982 Cross-site Scripting vulnerability in Fusionpbx
In FusionPBX up to v4.5.7, the file app\access_controls\access_control_nodes.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS.
network
low complexity
fusionpbx CWE-79
6.1
6.1
2019-10-21 CVE-2019-16981 Cross-site Scripting vulnerability in Fusionpbx
In FusionPBX up to v4.5.7, the file app\conference_profiles\conference_profile_params.php uses an unsanitized "id" variable coming from the URL, which is reflected on 2 occasions in HTML, leading to XSS.
network
low complexity
fusionpbx CWE-79
6.1
6.1
2019-10-21 CVE-2019-16990 Path Traversal vulnerability in Fusionpbx
In FusionPBX up to v4.5.7, the file app/music_on_hold/music_on_hold.php uses an unsanitized "file" variable coming from the URL, which takes any pathname (base64 encoded) and allows a download of it.
network
low complexity
fusionpbx CWE-22
6.5
6.5
2019-10-21 CVE-2019-16980 SQL Injection vulnerability in Fusionpbx
In FusionPBX up to v4.5.7, the file app\call_broadcast\call_broadcast_edit.php uses an unsanitized "id" variable coming from the URL in an unparameterized SQL query, leading to SQL injection.
network
low complexity
fusionpbx CWE-89
8.8
8.8
2019-10-21 CVE-2019-16979 Cross-site Scripting vulnerability in Fusionpbx
In FusionPBX up to v4.5.7, the file app\contacts\contact_urls.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS.
network
low complexity
fusionpbx CWE-79
6.1
6.1
2019-10-21 CVE-2019-16978 Cross-site Scripting vulnerability in Fusionpbx
In FusionPBX up to v4.5.7, the file app\devices\device_settings.php uses an unsanitized "id" variable coming from the URL, which is reflected on 2 occasions in HTML, leading to XSS.
network
low complexity
fusionpbx CWE-79
6.1
6.1
2019-09-05 CVE-2019-15029 OS Command Injection vulnerability in Fusionpbx 4.4.8
FusionPBX 4.4.8 allows an attacker to execute arbitrary system commands by submitting a malicious command to the service_edit.php file (which will insert the malicious command into the database).
network
low complexity
fusionpbx CWE-78
critical
 9.0
9.0
2019-06-17 CVE-2019-11410 OS Command Injection vulnerability in Fusionpbx 4.4.3
app/backup/index.php in the Backup Module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation, which allows authenticated administrative attackers to execute commands on the host.
network
low complexity
fusionpbx CWE-78
critical
 9.0
9.0
2019-06-17 CVE-2019-11409 OS Command Injection vulnerability in Fusionpbx 4.4.3
app/operator_panel/exec.php in the Operator Panel module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation that allows authenticated non-administrative attackers to execute commands on the host.
network
low complexity
fusionpbx CWE-78
6.5
6.5
2019-06-17 CVE-2019-11408 Cross-site Scripting vulnerability in Fusionpbx 4.4.3
XSS in app/operator_panel/index_inc.php in the Operator Panel module in FusionPBX 4.4.3 allows remote unauthenticated attackers to inject arbitrary JavaScript characters by placing a phone call using a specially crafted caller ID number.
network
fusionpbx CWE-79
4.3
4.3