Cross site scripting

A cross-site scripting XSS vulnerability in app/xmlcdr/xmlcdrsearch.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter...

Cross site scripting

A cross-site scripting XSS vulnerability in app/fax/faxfiles.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter...

CVE-2019-19366

FusionPBX 4.4.1 is affected by a cross-site scripting (XSS) vulnerability in the web UI: the redirect parameter in app/xml_cdr/xml_cdr_search.php can be abused to inject arbitrary script/HTML. Public references (NVD) list CVE-2019-19366 with a network-exposed impact and provide CVSS vectors (2.0/...

CVE-2019-19366

A cross-site scripting XSS vulnerability in app/xmlcdr/xmlcdrsearch.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter...

CVE-2019-19367

A cross-site scripting XSS vulnerability in app/fax/faxfiles.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter...

CVE-2019-19367

The CVE-2019-19367 entry concerns FusionPBX 4.4.1, where a cross-site scripting (XSS) flaw exists in the file app/fax/fax_files.php. The vulnerability is triggered via the id parameter and allows remote attackers to inject arbitrary web script or HTML. Publicly available connected sources consist...

CVE-2019-19366: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in app/xmlcdr/xmlcdrsearch.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter...

CVE-2019-19367: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in app/fax/faxfiles.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter...

FusionPBX Cross-Site Scripting Vulnerability (CNVD-2019-47028)

FusionPBX is a scalable, multi-threaded communications platform. The platform can be used as a call center server, fax server, VOIP server, voicemail server, conference server and voice application server. A cross-site scripting vulnerability exists in the app/fax/faxfiles.php file in FusionPBX...

FusionPBX - Operator Panel exec.php Command Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'FusionPBX Operator Panel exec.php Command Execution', 'Description' = %q This module exploits an authenticated command injection vulnerability in...

FusionPBX Command (exec.php) Command Execution Exploit

This Metasploit module uses administrative functionality available in FusionPBX to gain a shell. The Command section of the application permits users with execview permissions, or superadmin permissions, to execute arbitrary system commands, or arbitrary PHP code, as the web server user. This...

FusionPBX Operator Panel (exec.php) Command Execution Exploit

This Metasploit module exploits an authenticated command injection vulnerability in FusionPBX versions 4.4.3 and prior. The exec.php file within the Operator Panel permits users with operatorpanelview permissions, or administrator permissions, to execute arbitrary commands as the web server user ...

FusionPBX Operator Panel exec.php Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'FusionPBX Operator Panel exec.php Command Execution', 'Description' = %q This module exploits an authenticated command injection vulnerability in...

FusionPBX Command exec.php Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'FusionPBX Command exec.php Command Execution', 'Description' = %q This module uses administrative functionality available in FusionPBX to gain a...

FusionPBX Command exec.php Command Execution

This module uses administrative functionality available in FusionPBX to gain a shell. The Command section of the application permits users with execview permissions, or superadmin permissions, to execute arbitrary system commands, or arbitrary PHP code, as the web server user. This module has bee...

FusionPBX Cross-Site Scripting Vulnerability (CNVD-2019-38806)

FusionPBX is a scalable, multi-threaded communications platform. The platform can be used as a call center server, fax server, VOIP server, voicemail server, conference server and voice application server. A cross-site scripting vulnerability exists in FusionPBX. An attacker can exploit this...

FusionPBX Cross-Site Scripting Vulnerability (CNVD-2019-38805)

FusionPBX is a scalable, multi-threaded communications platform. The platform can be used as a call center server, fax server, VOIP server, voicemail server, conference server and voice application server. A cross-site scripting vulnerability exists in FusionPBX. An attacker can exploit this...

FusionPBX Cross-Site Scripting Vulnerability (CNVD-2019-38071)

FusionPBX is a scalable, multi-threaded communications platform. The platform can be used as a call center server, fax server, VOIP server, voicemail server, conference server and voice application server. A cross-site scripting vulnerability exists in FusionPBX 4.5.7 and earlier versions, which...

CVE-2019-16977

In FusionPBX up to 4.5.7, the file app\extensions\extensionimports.php uses an unsanitized "querystring" variable coming from the URL, which is reflected in HTML, leading to XSS...

CVE-2019-16977

In FusionPBX up to 4.5.7, the file app\extensions\extensionimports.php uses an unsanitized "querystring" variable coming from the URL, which is reflected in HTML, leading to XSS...