20 matches found
Sangoma Switchvox < 8.4.0.2 - Unauthenticated SQL Injection
Sangoma Switchvox before version 8.4.0.2 contains an unauthenticated SQL injection vulnerability in the /pa endpoint PhoneAppsHandler.pm. The PhoneIP field extracted from an XML POST body is concatenated directly into an unparameterized PostgreSQL query that runs as a database superuser. An...
Sangoma Switchvox SQL Injection Vulnerability
Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution...
VulnCheck KEV: CVE-2026-9586
An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 104997. The /pa endpoint processes XML content beginning with and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated...
CVE-2026-9588
A stored cross-site scripting XSS vulnerability exists in Sangoma Switchvox SMB Edition 8.3 104997 within the voicemail notification template functionality. The submitmodifyvoicemailtemplate endpoint fails to properly sanitize HTML content supplied by authenticated users, allowing malicious...
CVE-2026-9587
An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 104997. The playfile functionality accepts user-controlled input through the soundpath parameter and fails to properly validate file paths before accessing the underlying filesystem. By supplying...
CVE-2026-9586
An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 104997. The /pa endpoint processes XML content beginning with and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated...
CVE-2026-9585
An unauthenticated reflected cross-site scripting XSS vulnerability exists in Sangoma Switchvox SMB Edition version 8.3 104997. The application fails to properly sanitize the portal parameter supplied to the invalidbrowser and invalidbrowserlogin handlers. User-supplied data is reflected into...
CVE-2026-9588
A stored cross-site scripting XSS vulnerability exists in Sangoma Switchvox SMB Edition 8.3 104997 within the voicemail notification template functionality. The submitmodifyvoicemailtemplate endpoint fails to properly sanitize HTML content supplied by authenticated users, allowing malicious...
CVE-2026-9585
An unauthenticated reflected cross-site scripting XSS vulnerability exists in Sangoma Switchvox SMB Edition version 8.3 104997. The application fails to properly sanitize the portal parameter supplied to the invalidbrowser and invalidbrowserlogin handlers. User-supplied data is reflected into...
PT-2026-60810
Name of the Vulnerable Software and Affected Versions Sangoma Switchvox versions prior to 8.4.0.2 Description An unauthenticated SQL injection exists in the /pa endpoint, which processes XML content beginning with . The issue occurs because the PhoneIP variable is concatenated directly into...
PT-2026-60809
An unauthenticated reflected cross-site scripting XSS vulnerability exists in Sangoma Switchvox SMB Edition version 8.3 104997. The application fails to properly sanitize the portal parameter supplied to the invalid browser and invalid browser login handlers. User-supplied data is reflected into...
EUVD-2026-29354
Sangoma Switchvox before 8.4 places cleartext SIP authentication credentials in a backup file...
CVE-2026-45362
Sangoma Switchvox before 8.4 places cleartext SIP authentication credentials in a backup file...
CVE-2026-45362
Sangoma Switchvox before 8.4 places cleartext SIP authentication credentials in a backup file...
CVE-2026-45362
Sangoma Switchvox before 8.4 places cleartext SIP authentication credentials in a backup file...
CVE-2026-45362
Sangoma Switchvox before 8.4 places cleartext SIP authentication credentials in a backup file...
CVE-2026-45362
Summary : CVE-2026-45362 affects Sangoma Switchvox prior to version 8.4, where cleartext SIP authentication credentials are stored in a backup file. What’s affected : Switchvox software (versions before 8.4). Root cause / nature : Credentials are written in cleartext in a backup file, exposing SI...
PT-2026-39906
Sangoma Switchvox before 8.4 places cleartext SIP authentication credentials in a backup file...
Sangoma Technologies Switchvox 安全漏洞
Sangoma Technologies Switchvox is a telephone system developed by Sangoma Technologies in Canada, suitable for businesses of any size. Prior to the version 8.4 of Sangoma Technologies Switchvox, there was a security vulnerability. This vulnerability stemmed from the storage of plaintext SIP...