CVE-2023-37599

The CVE-2023-37599 entry affects Issabel PBX version 4.0.0-6, where a vulnerability in the modules directory could allow a remote attacker to obtain sensitive information. The connected Nuclei template names Issabel PBX 4.0.0-6 and documents directory listing as the attack vector, stating that an...

CVE-2024-0986

CVE-2024-0986 affects Issabel PBX 4.0.0 through the Asterisk-Cli component. The vulnerability arises from improper handling of the Command argument in /index.php?menu=asterisk_cli, enabling OS command injection. Multiple connected sources describe this as an authenticated remote command execution...

CVE-2021-46558

CVE-2021-46558 concerns Issabel PBX 20200102 with multiple XSS vulnerabilities in the Add User module. The flaws allow an attacker to inject arbitrary web scripts or HTML through crafted payloads in the username and password fields, enabling client-side script execution. Documented impact is limi...

CVE-2021-34190

CVE-2021-34190 is a stored XSS vulnerability in Issabel PBX version 4. The issue occurs in index.php?menu=billing_rates where an attacker can inject arbitrary web scripts/HTML via crafted payloads entered into the Name or Prefix fields under the Create New Rate module. Connected sources confirm t...

CVE-2023-34839

CVE-2023-34839 affects Issabel issabel-pbx v4.0.0-6. The vulnerability is a Cross-Site Request Forgery (CSRF) that allows an authenticated attacker to gain privileges by exploiting a crafted CSRF to create a new user with administrator rights in the application. Evidence across multiple sources (...

CVE-2023-37598

CVE-2023-37598 affects issabel-pbx v4.0.0-6 with a CSRF flaw in the delete new virtual fax functionality. The issue allows a remote attacker, via a crafted request, to delete a user’s virtual fax when an authenticated session is active, potentially causing denial of service. Concrete exploit deta...

CVE-2023-37596

Summary: CVE-2023-37596 is a CSRF vulnerability in issabel-pbx v4.0.0-6 that enables a remote attacker to cause a denial of service by crafting a request to the deleteuser function. This is documented across multiple sources (NVD, Red Hat, CNNVD, CVE list, etc.). The vulnerability affects the del...

CVE-2023-37597

The CVE-2023-37597 entry concerns issabel-pbx 4.0.0-6 and describes a Cross Site Request Forgery (CSRF) vulnerability that allows a remote attacker to cause a denial of service by abusing the delete user grouplist function. Exploitation details and PoC are available in a GitHub exploit (issabel-p...

CVE-2023-37190

CVE-2023-37190 affects Issabel issabel-pbx v4.0.0-6, where a stored XSS in the New Virtual Fax feature allows injection of scripts via crafted payloads into the Virtual Fax Name or Caller ID Name fields. The underlying issue is a lack of proper input sanitization in these parameters, leading to e...

CVE-2023-37191

CVE-2023-37191 is a stored cross-site scripting (XSS) in Issabel issabel-pbx v4.0.0-6. The vulnerability allows an attacker to inject arbitrary web scripts or HTML via payloads into the Group and Description fields, leading to execution in the victim’s browser. Connected documents confirm the aff...

CVE-2021-43695

Summary: CVE-2021-43695 affects issabelPBX 2.11. The vulnerability exists in page.backup_restore.php where the exit function prints a message containing unsanitized $_REQUEST, enabling a reflected XSS. The available documents do not specify a patch or workaround. The issue is confirmed across mul...

CVE-2023-37189

CVE-2023-37189 affects Issabel PBX v4, where a stored XSS exists in index.php?menu=billing_rates via crafted payloads in Name or Prefix under Create New Rate. The underlying issue allows execution of arbitrary web scripts/HTML in authenticated contexts. Public details consistently describe the vu...