CVE-2024-24539 | Medium | 5.3 | 2024-03-18 | FusionPBX before 5.2.0 does not validate a session. |
CVE-2024-23387 | Medium | 4.8 | 2024-01-19 | FusionPBX prior to 5.1.0 contains a cross-site scripting vulnerability. If this vulnerability is exploited by a remote authenticated attacker with an administr… |
CVE-2021-43403 | Medium | 6.5 | 2022-09-29 | An issue was discovered in FusionPBX before 4.5.30. The log_viewer.php Log View page allows an authenticated user to choose an arbitrary filename for download… |
CVE-2022-35153 | Critical | 9.8 | 2022-08-18 | FusionPBX 5.0.1 was discovered to contain a command injection vulnerability via /fax/fax_send.php. |
CVE-2021-37524 | Medium | 6.1 | 2022-07-01 | Cross Site Scripting (XSS) vulnerability in FusionPBX 4.5.26 allows remote unauthenticated users to inject arbitrary web script or HTML via an unsanitized "pat… |
CVE-2022-28055 | Critical | 9.8 | 2022-05-04 | Fusionpbx v4.4 and below contains a command injection vulnerability via the download email logs function. |
CVE-2021-43406 | High | 8.8 | 2021-11-05 | An issue was discovered in FusionPBX before 4.5.30. The fax_post_size may have risky characters (it is not constrained to preset values). |
CVE-2021-43405 | High | 8.8 | 2021-11-05 | An issue was discovered in FusionPBX before 4.5.30. The fax_extension may have risky characters (it is not constrained to be numeric). |
CVE-2021-43404 | High | 8.8 | 2021-11-05 | An issue was discovered in FusionPBX before 4.5.30. The FAX file name may have risky characters. |
CVE-2020-21057 | High | 8.1 | 2021-05-20 | Directory Traversal vulnerability in FusionPBX 4.5.7, which allows a remote malicious user to delete folders on the system via the folder variable to app/edit/… |
CVE-2020-21056 | Medium | 4.3 | 2021-05-20 | Directory Traversal vulnerability exists in FusionPBX 4.5.7, which allows a remote malicious user to create folders via the folder variale to app\edit\folderne… |
CVE-2020-21055 | Medium | 6.5 | 2021-05-20 | A Directory Traversal vulnerability exists in FusionPBX 4.5.7 allows malicoius users to rename any file of the system.via the (1) folder, (2) filename, and (3)… |
CVE-2020-21054 | Medium | 6.1 | 2021-05-20 | Cross Site Scripting (XSS) vulnerability in FusionPBX 4.5.7 allows remote malicious users to inject arbitrary web script or HTML via an unsanitized "f" variabl… |
CVE-2020-21053 | Medium | 6.1 | 2021-05-20 | Cross Site Scriptiong (XSS) vulnerability exists in FusionPBX 4.5.7 allows remote malicious users to inject arbitrary web script or HTML via an unsanitized "qu… |
CVE-2019-19388 | Medium | 6.1 | 2019-11-29 | A cross-site scripting (XSS) vulnerability in app/dialplans/dialplan_detail_edit.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script… |
CVE-2019-19387 | Medium | 6.1 | 2019-11-29 | A cross-site scripting (XSS) vulnerability in app/fifo_list/fifo_interactive.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or H… |
CVE-2019-19386 | Medium | 6.1 | 2019-11-29 | A cross-site scripting (XSS) vulnerability in app/voicemail_greetings/voicemail_greeting_edit.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrar… |
CVE-2019-19385 | Medium | 6.1 | 2019-11-29 | A cross-site scripting (XSS) vulnerability in app/dialplans/dialplans.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via… |
CVE-2019-19384 | Medium | 6.1 | 2019-11-29 | A cross-site scripting (XSS) vulnerability in app/fax/fax_log_view.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via th… |
CVE-2019-19367 | Medium | 6.1 | 2019-11-27 | A cross-site scripting (XSS) vulnerability in app/fax/fax_files.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the i… |
CVE-2019-19366 | Medium | 6.1 | 2019-11-27 | A cross-site scripting (XSS) vulnerability in app/xml_cdr/xml_cdr_search.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML… |
CVE-2019-16977 | Medium | 6.1 | 2019-10-23 | In FusionPBX up to 4.5.7, the file app\extensions\extension_imports.php uses an unsanitized "query_string" variable coming from the URL, which is reflected in… |
CVE-2019-16975 | Medium | 6.1 | 2019-10-23 | In FusionPBX up to 4.5.7, the file app\contacts\contact_notes.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to… |
CVE-2019-16976 | Medium | 6.1 | 2019-10-23 | In FusionPBX up to 4.5.7, the file app\destinations\destination_imports.php uses an unsanitized "query_string" variable coming from the URL, which is reflected… |
CVE-2019-16973 | Medium | 6.1 | 2019-10-22 | In FusionPBX up to 4.5.7, the file app\contacts\contact_edit.php uses an unsanitized "query_string" variable coming from the URL, which is reflected in HTML, l… |
CVE-2019-16972 | Medium | 6.1 | 2019-10-22 | In FusionPBX up to 4.5.7, the file app\contacts\contact_addresses.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leadin… |
CVE-2019-16971 | Medium | 6.1 | 2019-10-22 | In FusionPBX up to 4.5.7, the file app\messages\messages_thread.php uses an unsanitized "contact_uuid" variable coming from the URL, which is reflected on 3 oc… |
CVE-2019-16974 | Medium | 6.1 | 2019-10-21 | In FusionPBX up to 4.5.7, the file app\contacts\contact_times.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to… |
CVE-2019-16969 | Medium | 6.1 | 2019-10-21 | In FusionPBX up to 4.5.7, the file app\fifo_list\fifo_interactive.php uses an unsanitized "c" variable coming from the URL, which is reflected in HTML, leading… |
CVE-2019-16970 | Medium | 6.1 | 2019-10-21 | In FusionPBX up to 4.5.7, the file app\sip_status\sip_status.php uses an unsanitized "savemsg" variable coming from the URL, which is reflected in HTML, leadin… |
CVE-2019-16968 | Medium | 6.1 | 2019-10-21 | An issue was discovered in FusionPBX up to 4.5.7. In the file app\conference_controls\conference_control_details.php, an unsanitized id variable coming from th… |
CVE-2019-16965 | High | 7.2 | 2019-10-21 | resources/cmd.php in FusionPBX up to 4.5.7 suffers from a command injection vulnerability due to a lack of input validation, which allows authenticated adminis… |
CVE-2019-16964 | High | 8.8 | 2019-10-21 | app/call_centers/cmd.php in the Call Center Queue Module in FusionPBX up to 4.5.7 suffers from a command injection vulnerability due to a lack of input validat… |
CVE-2019-16991 | Medium | 6.1 | 2019-10-21 | In FusionPBX up to v4.5.7, the file app\edit\filedelete.php uses an unsanitized "file" variable coming from the URL, which is reflected in HTML, leading to XSS. |
CVE-2019-16989 | Medium | 6.1 | 2019-10-21 | In FusionPBX up to v4.5.7, the file app\conferences_active\conference_interactive.php uses an unsanitized "c" variable coming from the URL, which is reflected… |
CVE-2019-16988 | Medium | 6.1 | 2019-10-21 | In FusionPBX up to v4.5.7, the file app\basic_operator_panel\resources\content.php uses an unsanitized "eavesdrop_dest" variable coming from the URL, which is… |
CVE-2019-16987 | Medium | 6.1 | 2019-10-21 | In FusionPBX up to v4.5.7, the file app\contacts\contact_import.php uses an unsanitized "query_string" variable coming from the URL, which is reflected in HTML… |
CVE-2019-16986 | Medium | 6.5 | 2019-10-21 | In FusionPBX up to v4.5.7, the file resources\download.php uses an unsanitized "f" variable coming from the URL, which takes any pathname and allows a download… |
CVE-2019-16985 | Medium | 6.5 | 2019-10-21 | In FusionPBX up to v4.5.7, the file app\xml_cdr\xml_cdr_delete.php uses an unsanitized "rec" variable coming from the URL, which is base64 decoded and allows d… |
CVE-2019-16984 | Medium | 6.1 | 2019-10-21 | In FusionPBX up to v4.5.7, the file app\recordings\recording_play.php uses an unsanitized "filename" variable coming from the URL, which is base64 decoded and… |
CVE-2019-16983 | Medium | 6.1 | 2019-10-21 | In FusionPBX up to v4.5.7, the file resources\paging.php has a paging function (called by several pages of the interface), which uses an unsanitized "param" va… |
CVE-2019-16982 | Medium | 6.1 | 2019-10-21 | In FusionPBX up to v4.5.7, the file app\access_controls\access_control_nodes.php uses an unsanitized "id" variable coming from the URL, which is reflected in H… |
CVE-2019-16981 | Medium | 6.1 | 2019-10-21 | In FusionPBX up to v4.5.7, the file app\conference_profiles\conference_profile_params.php uses an unsanitized "id" variable coming from the URL, which is refle… |
CVE-2019-16990 | Medium | 6.5 | 2019-10-21 | In FusionPBX up to v4.5.7, the file app/music_on_hold/music_on_hold.php uses an unsanitized "file" variable coming from the URL, which takes any pathname (base… |
CVE-2019-16980 | High | 8.8 | 2019-10-21 | In FusionPBX up to v4.5.7, the file app\call_broadcast\call_broadcast_edit.php uses an unsanitized "id" variable coming from the URL in an unparameterized SQL… |
CVE-2019-16979 | Medium | 6.1 | 2019-10-21 | In FusionPBX up to v4.5.7, the file app\contacts\contact_urls.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to… |
CVE-2019-16978 | Medium | 6.1 | 2019-10-21 | In FusionPBX up to v4.5.7, the file app\devices\device_settings.php uses an unsanitized "id" variable coming from the URL, which is reflected on 2 occasions in… |
CVE-2019-15029 | High | 8.8 | 2019-09-05 | FusionPBX 4.4.8 allows an attacker to execute arbitrary system commands by submitting a malicious command to the service_edit.php file (which will insert the m… |
CVE-2019-11410 | High | 7.2 | 2019-06-17 | app/backup/index.php in the Backup Module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation, which allows aut… |
CVE-2019-11409 | High | 8.8 | 2019-06-17 | app/operator_panel/exec.php in the Operator Panel module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation th… |
CVE-2019-11408 | Medium | 6.1 | 2019-06-17 | XSS in app/operator_panel/index_inc.php in the Operator Panel module in FusionPBX 4.4.3 allows remote unauthenticated attackers to inject arbitrary JavaScript… |
CVE-2019-11407 | High | 7.2 | 2019-06-17 | app/operator_panel/index_inc.php in the Operator Panel module in FusionPBX 4.4.3 suffers from an information disclosure vulnerability due to excessive debug in… |