CVE-2008-6894: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in login.php in 3CX Phone System Free Edition 6.1793 and 6.0.806.0 allow remote attackers to inject arbitrary web script or HTML via the 1 fName and 2 fPassword parameters...

CVE-2008-6896: Exposure of Sensitive Information to an Unauthorized Actor

login.php in 3CX Phone System 6.0.806.0, when 100% disk capacity is reached, allows remote attackers to gain sensitive information via unspecified vectors that reveal the installation path...