CVE-2019-16976

In FusionPBX up to 4.5.7, the file app\destinations\destinationimports.php uses an unsanitized "querystring" variable coming from the URL, which is reflected on 2 occasions in HTML, leading to XSS...

CVE-2019-16976

In FusionPBX up to 4.5.7, the file app\destinations\destinationimports.php uses an unsanitized "querystring" variable coming from the URL, which is reflected on 2 occasions in HTML, leading to XSS...

CVE-2019-16976

CVE-2019-16976 affects FusionPBX up to version 4.5.7. The vulnerability is a reflected cross‑site scripting (XSS) caused by an unsanitized URL parameter in the file app\destinations\destination_imports.php where the parameter named query_string is echoed in the HTML on two occasions. Publicly ava...