CVE-2023-27362 | High | 7.8 | 2024-05-03 | 3CX Uncontrolled Search Path Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installatio… |
CVE-2023-49954 | Critical | 9.8 | 2023-12-25 | The CRM Integration in 3CX before 18.0.9.23 and 20 before 20.0.0.1494 allows SQL Injection via a first name, search string, or email address. |
CVE-2022-48483 | High | 7.5 | 2023-05-02 | 3CX before 18 Hotfix 1 build 18.0.3.461 on Windows allows unauthenticated remote attackers to read %WINDIR%\system32 files via /Electron/download directory tra… |
CVE-2022-48482 | High | 7.5 | 2023-05-02 | 3CX before 18 Update 2 Security Hotfix build 18.0.2.315 on Windows allows unauthenticated remote attackers to read certain files via /Electron/download directo… |
CVE-2023-29059 | High | 7.8 | 2023-03-30 | 3CX DesktopApp through 18.12.416 has embedded malicious code, as exploited in the wild in March 2023. This affects versions 18.12.407 and 18.12.416 of the 3CX… |
CVE-2019-9972 | High | 8.8 | 2022-06-07 | PhoneSystem Terminal in 3CX Phone System (Debian based installation) 16.0.0.1570 allows an authenticated attacker to run arbitrary commands with the phonesyste… |
CVE-2019-9971 | High | 8.8 | 2022-06-07 | PhoneSystem Terminal in 3CX Phone System (Debian based installation) 16.0.0.1570 allows an attacker to gain root privileges by using sudo with the tcpdump comm… |
CVE-2022-27438 | High | 8.1 | 2022-06-06 | Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer (Advanced Updater) are affected by a remote code… |
CVE-2022-28005 | Critical | 9.8 | 2022-05-06 | An issue was discovered in the 3CX Phone System Management Console prior to version 18 Update 3 FINAL. An unauthenticated attacker could abuse improperly secur… |
CVE-2021-45491 | Medium | 6.5 | 2022-03-28 | 3CX System through 2022-03-17 stores cleartext passwords in a database. |
CVE-2021-45490 | Critical | 9.1 | 2022-03-28 | The client applications in 3CX on Windows, the 3CX app for iOS, and the 3CX application for Android through 2022-03-17 lack SSL certificate validation. |
CVE-2019-12498 | Critical | 9.8 | 2020-03-20 | The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplc_api_permission_check protection mechanism. |
CVE-2014-10386 | Medium | 6.1 | 2019-08-22 | The wp-live-chat-support plugin before 4.1.0 for WordPress has JavaScript injections. |
CVE-2017-18507 | Medium | 6.1 | 2019-08-13 | The wp-live-chat-support plugin before 7.1.05 for WordPress has XSS. |
CVE-2019-14950 | Medium | 6.1 | 2019-08-12 | The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page. |
CVE-2017-18508 | Medium | 6.1 | 2019-08-12 | The wp-live-chat-support plugin before 7.1.03 for WordPress has XSS. |
CVE-2016-10879 | Medium | 6.1 | 2019-08-12 | The wp-live-chat-support plugin before 6.2.02 for WordPress has XSS. |
CVE-2019-14935 | High | 7.8 | 2019-08-12 | 3CX Phone 15 on Windows has insecure permissions on the "%PROGRAMDATA%\3CXPhone for Windows\PhoneApp" installation directory, allowing Full Control access for… |
CVE-2019-13176 | High | 7.5 | 2019-08-08 | An issue was discovered in the 3CX Phone system (web) management console 12.5.44178.1002 through 12.5 SP2. The Content.MainForm.wgx component is affected by XX… |
CVE-2019-11185 | Critical | 9.8 | 2019-06-03 | The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability. This results from an incomplete patch for CVE… |
CVE-2019-9913 | Medium | 6.1 | 2019-03-22 | The wp-live-chat-support plugin before 8.0.18 for WordPress has wp-admin/admin.php?page=wplivechat-menu-gdpr-page term XSS. |
CVE-2018-18460 | Medium | 6.1 | 2018-10-18 | XSS exists in the wp-live-chat-support v8.0.15 plugin for WordPress via the modules/gdpr.php term parameter in a wp-admin/admin.php wplivechat-menu-gdpr-page r… |
CVE-2018-14907 | Medium | 5.3 | 2018-08-03 | The Web server in 3CX version 15.5.8801.3 is vulnerable to Information Leakage, because of improper error handling in Stack traces, as demonstrated by discover… |
CVE-2018-14906 | Medium | 6.1 | 2018-08-03 | The Web server in 3CX version 15.5.8801.3 is vulnerable to Reflected XSS on all stack traces' propertyPath parameters. |
CVE-2018-14905 | Medium | 6.1 | 2018-08-03 | The Web server in 3CX version 15.5.8801.3 is vulnerable to Reflected XSS on the api/CallLog TimeZoneName parameter. |
CVE-2018-12426 | Critical | 9.8 | 2018-07-02 | The WP Live Chat Support Pro plugin before 8.0.07 for WordPress is vulnerable to unauthenticated Remote Code Execution due to client-side validation of allowed… |
CVE-2018-11105 | Medium | 6.1 | 2018-05-15 | There is stored cross site scripting in the wp-live-chat-support plugin before 8.0.08 for WordPress via the "name" (aka wplc_name) and "email" (aka wplc_email)… |
CVE-2018-9864 | Medium | 6.1 | 2018-04-09 | The WP Live Chat Support plugin before 8.0.06 for WordPress has stored XSS via the Name field. |
CVE-2018-7654 | Medium | 6.5 | 2018-03-04 | On 3CX 15.5.6354.2 devices, the parameter "file" in the request "/api/RecordingList/download?file=" allows full access to files on the server via path traversa… |
CVE-2017-15359 | Medium | 6.5 | 2017-10-18 | In the 3CX Phone System 15.5.3554.1, the Management Console typically listens to port 5001 and is prone to a directory traversal attack: "/api/RecordingList/Do… |
CVE-2017-2187 | Medium | 6.1 | 2017-06-09 | Cross-site scripting vulnerability in WP Live Chat Support prior to version 7.0.07 allows remote attackers to inject arbitrary web script or HTML via unspecifi… |
CVE-2008-6896 | | | 2009-08-03 | login.php in 3CX Phone System 6.0.806.0, when 100% disk capacity is reached, allows remote attackers to gain sensitive information via unspecified vectors that… |
CVE-2008-6895 | | | 2009-08-03 | 3CX Phone System 6.0.806.0 allows remote attackers to cause a denial of service (unstable service or crash) via unspecified vectors, as demonstrated by vulnera… |
CVE-2008-6894 | | | 2009-08-03 | Multiple cross-site scripting (XSS) vulnerabilities in login.php in 3CX Phone System Free Edition 6.1793 and 6.0.806.0 allow remote attackers to inject arbitra… |