CVE-2024-24386

The VitalPBX unified communication system (versions 3.2.4 through 3.2.5 ) is vulnerable to arbitrary code execution via a command injection flaw in the Task Manager module. The root cause is insufficient protection of service data when processing scripts from the /var/lib/vitalpbx/scripts directo...