Fusionpbx Fusionpbx
52 CVEs affecting Fusionpbx Fusionpbx. Latest disclosed: 2024-03-18. Critical: 2, High: 11.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-35153 | Critical | 9.8 | 2022-08-18 | FusionPBX 5.0.1 was discovered to contain a command injection vulnerability via /fax/fax_send.php. |
CVE-2022-28055 | Critical | 9.8 | 2022-05-04 | Fusionpbx v4.4 and below contains a command injection vulnerability via the download email logs function. |
CVE-2021-43406 | High | 8.8 | 2021-11-05 | An issue was discovered in FusionPBX before 4.5.30. The fax_post_size may have risky characters (it is not constrained to preset values). |
CVE-2021-43405 | High | 8.8 | 2021-11-05 | An issue was discovered in FusionPBX before 4.5.30. The fax_extension may have risky characters (it is not constrained to be numeric). |
CVE-2021-43404 | High | 8.8 | 2021-11-05 | An issue was discovered in FusionPBX before 4.5.30. The FAX file name may have risky characters. |
CVE-2019-16964 | High | 8.8 | 2019-10-21 | app/call_centers/cmd.php in the Call Center Queue Module in FusionPBX up to 4.5.7 suffers from a command injection vulnerability due to a lack of input validat… |
CVE-2019-16980 | High | 8.8 | 2019-10-21 | In FusionPBX up to v4.5.7, the file app\call_broadcast\call_broadcast_edit.php uses an unsanitized "id" variable coming from the URL in an unparameterized SQL… |
CVE-2019-15029 | High | 8.8 | 2019-09-05 | FusionPBX 4.4.8 allows an attacker to execute arbitrary system commands by submitting a malicious command to the service_edit.php file (which will insert the m… |
CVE-2019-11409 | High | 8.8 | 2019-06-17 | app/operator_panel/exec.php in the Operator Panel module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation th… |
CVE-2020-21057 | High | 8.1 | 2021-05-20 | Directory Traversal vulnerability in FusionPBX 4.5.7, which allows a remote malicious user to delete folders on the system via the folder variable to app/edit/… |
CVE-2019-16965 | High | 7.2 | 2019-10-21 | resources/cmd.php in FusionPBX up to 4.5.7 suffers from a command injection vulnerability due to a lack of input validation, which allows authenticated adminis… |
CVE-2019-11410 | High | 7.2 | 2019-06-17 | app/backup/index.php in the Backup Module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation, which allows aut… |
CVE-2019-11407 | High | 7.2 | 2019-06-17 | app/operator_panel/index_inc.php in the Operator Panel module in FusionPBX 4.4.3 suffers from an information disclosure vulnerability due to excessive debug in… |
CVE-2021-43403 | Medium | 6.5 | 2022-09-29 | An issue was discovered in FusionPBX before 4.5.30. The log_viewer.php Log View page allows an authenticated user to choose an arbitrary filename for download… |
CVE-2020-21055 | Medium | 6.5 | 2021-05-20 | A Directory Traversal vulnerability exists in FusionPBX 4.5.7 allows malicoius users to rename any file of the system.via the (1) folder, (2) filename, and (3)… |
CVE-2019-16986 | Medium | 6.5 | 2019-10-21 | In FusionPBX up to v4.5.7, the file resources\download.php uses an unsanitized "f" variable coming from the URL, which takes any pathname and allows a download… |
CVE-2019-16985 | Medium | 6.5 | 2019-10-21 | In FusionPBX up to v4.5.7, the file app\xml_cdr\xml_cdr_delete.php uses an unsanitized "rec" variable coming from the URL, which is base64 decoded and allows d… |
CVE-2019-16990 | Medium | 6.5 | 2019-10-21 | In FusionPBX up to v4.5.7, the file app/music_on_hold/music_on_hold.php uses an unsanitized "file" variable coming from the URL, which takes any pathname (base… |
CVE-2021-37524 | Medium | 6.1 | 2022-07-01 | Cross Site Scripting (XSS) vulnerability in FusionPBX 4.5.26 allows remote unauthenticated users to inject arbitrary web script or HTML via an unsanitized "pat… |
CVE-2020-21054 | Medium | 6.1 | 2021-05-20 | Cross Site Scripting (XSS) vulnerability in FusionPBX 4.5.7 allows remote malicious users to inject arbitrary web script or HTML via an unsanitized "f" variabl… |