NCH Axon PBX is a set of virtual telephone switch software used in commercial environments. A cross-site scripting vulnerability exists in NCH Axon PBX, which stems from the failure of the productβs extension name to properly filter special characters in input data, and can be exploited to execute client-side code.