CVE-2019-16973

In FusionPBX up to 4.5.7, the file app\contacts\contactedit.php uses an unsanitized "querystring" variable coming from the URL, which is reflected in HTML, leading to XSS...

CVE-2019-16972

In FusionPBX up to 4.5.7, the file app\contacts\contactaddresses.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS...

CVE-2019-16973

In FusionPBX up to 4.5.7, the file app\contacts\contactedit.php uses an unsanitized "querystring" variable coming from the URL, which is reflected in HTML, leading to XSS...

CVE-2019-16971

In FusionPBX up to 4.5.7, the file app\messages\messagesthread.php uses an unsanitized "contactuuid" variable coming from the URL, which is reflected on 3 occasions in HTML, leading to XSS...

CVE-2019-16972

In FusionPBX up to 4.5.7, the file app\contacts\contactaddresses.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS...

Cross site scripting

In FusionPBX up to 4.5.7, the file app\contacts\contactaddresses.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS...

Cross site scripting

In FusionPBX up to 4.5.7, the file app\messages\messagesthread.php uses an unsanitized "contactuuid" variable coming from the URL, which is reflected on 3 occasions in HTML, leading to XSS...

Cross site scripting

In FusionPBX up to 4.5.7, the file app\contacts\contactedit.php uses an unsanitized "querystring" variable coming from the URL, which is reflected in HTML, leading to XSS...

CVE-2019-16973

FusionPBX ≤ 4.5.7 is affected by a reflected XSS in app\contacts\contact_edit.php where an unsanitized URL query_string is echoed into HTML. This is the root cause: unsanitized input from the URL being reflected, enabling cross-site scripting. Exploitation details are not provided in the document...

CVE-2019-16973

In FusionPBX up to 4.5.7, the file app\contacts\contactedit.php uses an unsanitized "querystring" variable coming from the URL, which is reflected in HTML, leading to XSS...

CVE-2019-16972

FusionPBX (up to 4.5.7) has a cross-site scripting (XSS) vulnerability in the file app\contacts\contact_addresses.php, where an unsanitized URL parameter id is reflected in HTML. The root cause is lack of input sanitization for the id from the URL, enabling injection of malicious script. Remediat...

CVE-2019-16972

In FusionPBX up to 4.5.7, the file app\contacts\contactaddresses.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS...

CVE-2019-16971

FusionPBX: CVE-2019-16971 affects versions up to 4.5.7. The vulnerability is a cross-site scripting (XSS) issue in file app\messages\messages_thread.php where an unsanitized contact_uuid from the URL is reflected in HTML on three occasions. Impact (per sources) is client-side code execution via c...

CVE-2019-16971

In FusionPBX up to 4.5.7, the file app\messages\messagesthread.php uses an unsanitized "contactuuid" variable coming from the URL, which is reflected on 3 occasions in HTML, leading to XSS...

FusionPBX Call Center Queue Module Command Injection Vulnerability

FusionPBX is a scalable, multi-threaded communication platform. The platform can be used as a call center server, fax server, VOIP server, voicemail server, conference server and voice application server, etc. Call Center Queue Module is one of the call center modules. A command injection...

FusionPBX Cross-Site Scripting Vulnerability (CNVD-2019-37372)

FusionPBX is a scalable, multi-threaded communications platform. The platform can be used as a call center server, fax server, VOIP server, voicemail server, conference server and voice application server. A cross-site scripting vulnerability exists in FusionPBX. An attacker can exploit this...

FusionPBX Cross-Site Scripting Vulnerability (CNVD-2019-37373)

FusionPBX is a scalable, multi-threaded communications platform. The platform can be used as a call center server, fax server, VOIP server, voicemail server, conference server and voice application server. A cross-site scripting vulnerability exists in FusionPBX. An attacker can exploit this...

FusionPBX Cross-Site Scripting Vulnerability (CNVD-2019-37878)

FusionPBX is a scalable, multi-threaded communications platform. The platform can be used as a call center server, fax server, VOIP server, voicemail server, conference server and voice application server. A cross-site scripting vulnerability exists in FusionPBX 4.5.7 and earlier versions, which...

FusionPBX Cross-Site Scripting Vulnerability (CNVD-2019-37375)

FusionPBX is a scalable, multi-threaded communications platform. The platform can be used as a call center server, fax server, VOIP server, voicemail server, conference server and voice application server. A cross-site scripting vulnerability exists in FusionPBX. An attacker can exploit this...

PT-2019-14892 · Fusionpbx · Fusionpbx

Name of the Vulnerable Software and Affected Versions: FusionPBX versions up to 4.5.7 Description: The issue arises from the file appcontactscontact addresses.php using an unsanitized id variable from the URL, which is then reflected in HTML. This leads to a cross-site scripting XSS issue, allowi...