CVE-2021-37458

Cross Site Scripting XSS exists in NCH Axon PBX v2.22 and earlier via the primary phone field stored...

CVE-2021-37456

Cross Site Scripting XSS exists in NCH Axon PBX v2.22 and earlier via the blacklist IP address stored...

Cross site scripting

Cross Site Scripting XSS exists in NCH Axon PBX v2.22 and earlier via the line name stored...

Cross site scripting

Cross Site Scripting XSS exists in NCH Axon PBX v2.22 and earlier via the outbound dialing plan stored...

CVE-2021-37459

Cross Site Scripting XSS exists in NCH Axon PBX v2.22 and earlier via the customer name field stored...

Cross site scripting

Cross Site Scripting XSS exists in NCH Axon PBX v2.22 and earlier via /ipblacklist?errorip= reflected...

Cross site scripting

Cross Site Scripting XSS exists in NCH Axon PBX v2.22 and earlier via the customer name field stored...

Cross site scripting

Cross Site Scripting XSS exists in NCH Axon PBX v2.22 and earlier via the SipRule field stored...

CVE-2021-37462

Cross Site Scripting XSS exists in NCH Axon PBX v2.22 and earlier via /ipblacklist?errorip= reflected...

Cross site scripting

Cross Site Scripting XSS exists in NCH Axon PBX v2.22 and earlier via /extensionsinstruction?id= reflected...

Cross site scripting

Cross Site Scripting XSS exists in NCH Axon PBX v2.22 and earlier via the primary phone field stored...

CVE-2021-37460

Cross Site Scripting XSS exists in NCH Axon PBX v2.22 and earlier via /planprop?id= reflected...

CVE-2021-37455

Cross Site Scripting XSS exists in NCH Axon PBX v2.22 and earlier via the outbound dialing plan stored...

CVE-2021-37440

NCH Axon PBX v2.22 and earlier are affected by a path traversal vulnerability in the logprop function, where a request parameter logprop?file=/.. can disclose arbitrary files. This is a file disclosure vulnerability caused by improper handling of the dot-dot sequence and is cataloged as CVE-2021-...

CVE-2021-37440

NCH Axon PBX v2.22 and earlier allows path traversal for file disclosure via the logprop?file=/.. substring...

CVE-2021-37441

NCH Axon PBX v2.22 and earlier allows path traversal for file deletion via the logdelete?file=/.. substring...

CVE-2021-37441

CVE-2021-37441 affects NCH Axon PBX v2.22 and earlier. The vulnerability is a path-traversal flaw in the logdelete function, exploitable via the logdelete?file=/.. parameter, enabling access to or deletion of arbitrary files outside the intended directory. The connected sources confirm the affect...

CVE-2021-37453

Cross Site Scripting XSS exists in NCH Axon PBX v2.22 and earlier via the extension name stored...

CVE-2021-37453

CVE-2021-37453 is a stored Cross Site Scripting (XSS) vulnerability in NCH Axon PBX up to v2.22 and earlier, triggered via the extension name (stored) . The root cause is inadequate filtering of special characters in input data, allowing injected script to run in the client context. Documented me...

CVE-2021-37454

CVE-2021-37454 affects NCH Axon PBX v2.22 and earlier. The issue is a stored XSS in the line name field, caused by insufficient filtering of special characters, enabling injection of client‑side scripts. Reported metrics indicate low to medium impact depending on vector/privileges, with user inte...