CVE-2019-16987

Summary: CVE-2019-16987 affects FusionPBX up to version 4.5.7. The vulnerability exists in the file app/contacts/contact_import.php, where an unsanitized query_string parameter from the URL is reflected in HTML, causing a reflected XSS. The linked Red Hat/NVD entries confirm the same issue. Impac...

CVE-2019-16987

In FusionPBX up to v4.5.7, the file app\contacts\contactimport.php uses an unsanitized "querystring" variable coming from the URL, which is reflected in HTML, leading to XSS...