EUVD-2019-7446

Malware in sbrugna...

CVE-2019-19387: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in app/fifolist/fifointeractive.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the c parameter...

CVE-2019-16969: Improper Neutralization of Input During Web Page Generation

In FusionPBX up to 4.5.7, the file app\fifolist\fifointeractive.php uses an unsanitized "c" variable coming from the URL, which is reflected in HTML, leading to XSS...