CVE-2019-16978

In FusionPBX up to v4.5.7, the file app\devices\devicesettings.php uses an unsanitized "id" variable coming from the URL, which is reflected on 2 occasions in HTML, leading to XSS...

CVE-2019-16980

In FusionPBX up to v4.5.7, the file app\callbroadcast\callbroadcastedit.php uses an unsanitized "id" variable coming from the URL in an unparameterized SQL query, leading to SQL injection...

CVE-2019-16979

In FusionPBX up to v4.5.7, the file app\contacts\contacturls.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS...

CVE-2019-16990

In FusionPBX up to v4.5.7, the file app/musiconhold/musiconhold.php uses an unsanitized "file" variable coming from the URL, which takes any pathname base64 encoded and allows a download of it...

Design/Logic Flaw

In FusionPBX up to v4.5.7, the file app/musiconhold/musiconhold.php uses an unsanitized "file" variable coming from the URL, which takes any pathname base64 encoded and allows a download of it...

Cross site scripting

In FusionPBX up to v4.5.7, the file app\contacts\contacturls.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS...

Sql injection

In FusionPBX up to v4.5.7, the file app\callbroadcast\callbroadcastedit.php uses an unsanitized "id" variable coming from the URL in an unparameterized SQL query, leading to SQL injection...

Cross site scripting

In FusionPBX up to v4.5.7, the file app\devices\devicesettings.php uses an unsanitized "id" variable coming from the URL, which is reflected on 2 occasions in HTML, leading to XSS...

CVE-2019-16982

In FusionPBX up to v4.5.7, the file app\accesscontrols\accesscontrolnodes.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS...

CVE-2019-16982

FusionPBX up to v4.5.7 is vulnerable to an XSS flaw in the file app/access_controls/access_control_nodes.php where an unsanitized id taken from the URL is reflected in HTML. This is caused by insufficient input sanitization in the access controls node listing, enabling injection of client-side sc...

CVE-2019-16990

In FusionPBX up to v4.5.7, the file app/musiconhold/musiconhold.php uses an unsanitized "file" variable coming from the URL, which takes any pathname base64 encoded and allows a download of it...

CVE-2019-16990

FusionPBX CVE-2019-16990 affects versions up to 4.5.7. The vulnerability is in music_on_hold.php where an unsanitized URL-derived file parameter (base64-encoded) enables downloading arbitrary pathnames. Core impact is potential exposure of files via crafted requests; exploitation details are not ...

CVE-2019-16979

CVE-2019-16979 affects FusionPBX up to version 4.5.7. The vulnerability is triggered by an unsanitized URL parameter in the file app\contacts\contact_urls.php , where the id value is reflected in HTML, causing a cross-site scripting (XSS) flaw. Public sources consistently describe the impact as c...

CVE-2019-16979

In FusionPBX up to v4.5.7, the file app\contacts\contacturls.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS...

CVE-2019-16980

In FusionPBX up to v4.5.7, the file app\callbroadcast\callbroadcastedit.php uses an unsanitized "id" variable coming from the URL in an unparameterized SQL query, leading to SQL injection...

CVE-2019-16980

CVE-2019-16980 affects FusionPBX up to v4.5.7. The vulnerable component is the file app\call_broadcast\call_broadcast_edit.php, which uses an unsanitized URL parameter (id) directly in an unparameterized SQL query, enabling SQL injection. The documented impact is SQL injection with the potential ...

CVE-2019-16978

In FusionPBX up to v4.5.7, the file app\devices\devicesettings.php uses an unsanitized "id" variable coming from the URL, which is reflected on 2 occasions in HTML, leading to XSS...

CVE-2019-16978

CVE-2019-16978 affects FusionPBX up to v4.5.7, where the file app\devices\device_settings.php reads an unsanitized id from the URL and reflects it twice in HTML, causing XSS. The issue arises from insufficient input sanitization in the device_settings component. Impact is client-side script execu...

PT-2019-14904 · Fusionpbx · Fusionpbx

Name of the Vulnerable Software and Affected Versions: FusionPBX versions prior to 4.5.8 Description: The issue concerns an XSS vulnerability in the paging function of the resourcespaging.php file. This function is called by several pages of the interface and uses an unsanitized param variable,...

PT-2019-14902 · Fusionpbx · Fusionpbx

Name of the Vulnerable Software and Affected Versions: FusionPBX versions prior to 4.5.8 Description: The issue concerns the use of an unsanitized id variable from the URL in the file appconference profilesconference profile params.php. This variable is reflected in HTML on two occasions, leading...