CVE-2019-16987

In FusionPBX up to v4.5.7, the file app\contacts\contactimport.php uses an unsanitized "querystring" variable coming from the URL, which is reflected in HTML, leading to XSS...

CVE-2019-16987

Summary: CVE-2019-16987 affects FusionPBX up to version 4.5.7. The vulnerability exists in the file app/contacts/contact_import.php, where an unsanitized query_string parameter from the URL is reflected in HTML, causing a reflected XSS. The linked Red Hat/NVD entries confirm the same issue. Impac...

CVE-2019-16987: Improper Neutralization of Input During Web Page Generation

In FusionPBX up to v4.5.7, the file app\contacts\contactimport.php uses an unsanitized "querystring" variable coming from the URL, which is reflected in HTML, leading to XSS...