CVE-2019-19552

In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the user management screen of the Administrator web site, i.e., the/admin/config.php?display=userman URI. An attacker with sufficient privileges can edit the Display Name of a user and embed malicious XSS code. When another...

PT-2019-15874

Name of the Vulnerable Software and Affected Versions Sangoma FreePBX userman versions 13.0.76.43 through 15.0.20 Description The issue exists in the user management screen of the Administrator website, specifically at the /admin/config.php?display=userman API endpoint. An attacker with sufficien...

CVE-2018-15892

FreePBX 13 and 14 has SQL Injection in the DISA module via the hangup variable on the /admin/config.php?display=disa&view=form page...

CVE-2018-15892

CVE-2018-15892 affects FreePBX 13 and 14, with SQL injection in the DISA module via the hangup variable on the /admin/config.php?display=disa&view=form page. Root cause: unsafely constructed SQL in the DISA form handling. Impact: confidentiality, integrity, and availability potentially affected (...

PT-2019-9198

Name of the Vulnerable Software and Affected Versions FreePBX versions 13 through 14 Description The issue concerns a SQL Injection in the DISA module. This occurs via the hangup variable on the "/admin/config.php?display=disa&view=form" API endpoint. Recommendations For FreePBX versions 13 throu...

CVE-2018-15892: Improper Neutralization of Special Elements used in an SQL Command

FreePBX 13 and 14 has SQL Injection in the DISA module via the hangup variable on the /admin/config.php?display=disa&view=form page...

PT-2018-12560

Name of the Vulnerable Software and Affected Versions SeaCMS version 6.61 Description The issue concerns two XSS problems located in the admin config.php file, specifically through certain form fields. Recommendations For SeaCMS version 6.61, update the admin config.php file to fix the XSS issues...

PT-2018-11167

Name of the Vulnerable Software and Affected Versions SeaCMS version 6.61 Description The issue is related to a Cross-Site Scripting XSS problem. It occurs via the site name parameter on the "adm1n/admin config.php" page, which is a system management page. Recommendations For SeaCMS version 6.61,...

CVE-2015-2690

Multiple cross-site scripting XSS vulnerabilities in views/add-license-form.php in the Digium Addons module digiumaddoninstaller before 2.11.0.7 for FreePBX allow remote attackers to inject arbitrary web script or HTML via the 1 addlicensekey, 2 addlicensefirstname, 3 addlicenselastname, 4...

CVE-2015-2690

Multiple cross-site scripting XSS vulnerabilities in views/add-license-form.php in the Digium Addons module digiumaddoninstaller before 2.11.0.7 for FreePBX allow remote attackers to inject arbitrary web script or HTML via the 1 addlicensekey, 2 addlicensefirstname, 3 addlicenselastname, 4...

CVE-2015-2690: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in views/add-license-form.php in the Digium Addons module digiumaddoninstaller before 2.11.0.7 for FreePBX allow remote attackers to inject arbitrary web script or HTML via the 1 addlicensekey, 2 addlicensefirstname, 3 addlicenselastname, 4...

PT-2017-6607

Name of the Vulnerable Software and Affected Versions FreePBX Digium Addons module digiumaddoninstaller versions prior to 2.11.0.7 Description The issue allows remote attackers to inject arbitrary web script or HTML via multiple parameters in an add-license-form page. The vulnerable parameters...

RedBLoG 0.5 admin/config.php root_path Parameter Remote File Inclusion

No description provided by source. source: http://www.securityfocus.com/bid/20115/info The redblog application is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues may allow an attacker to compromise the...

CVE-2014-1903

admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha22 does not restrict the set of functions accessible to the API handler, which allows remote attackers to execute arbitrary PHP code via the function and args...

CVE-2014-1903: Undefined Security Weakness

admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha22 does not restrict the set of functions accessible to the API handler, which allows remote attackers to execute arbitrary PHP code via the function and args...

PT-2014-4353

Name of the Vulnerable Software and Affected Versions FreePBX versions 2.9 through 2.9.0.13 FreePBX versions 2.10 through 2.10.1.14 FreePBX versions 2.11 through 2.11.0.22 FreePBX versions 12 through 12.0.1alpha21 Description The issue allows remote attackers to execute arbitrary PHP code via the...

CVE-2010-3490

CVE-2010-3490 affects FreePBX

Newbie CMS Insecure Cookie Handling

----------exploit Debut Insecure Cookie Handling Vulnerability ----------Script Info Moi : JIKO Site : No-exploit.Com Email : mm : Moghla9 Ferme Closed ----------Script Info Site : http://newbie-cms.com Download : http://newbie-cms.com/freedownload.php?file=newbiev003.zip ----------exploit Info...

CVE-2009-4458: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in FreePBX 2.5.2 and 2.6.0rc2, and possibly other versions, allow remote attackers to inject arbitrary web script or HTML via the 1 tech parameter to admin/admin/config.php during a trunks display action, the 2 description parameter during an Add...

CVE-2008-0351: Improper Authentication

admin/config.php in Evilsentinel 1.0.9 and earlier allows remote attackers to bypass the CAPTCHA test by omitting the essecuritycaptcha parameter and not invoking captcha.php...