File and Path Handling

Every one of the 6 is a mark on the map. Named now: 1 to 6, most at risk first.

1. Directory Traversal vulnerability in FusionPBX 4.5.7, which allows a remote malicious user to delete folders on the system via the folder variable to app/edit/folderdelete.php.CVE-2020-21057Fusionpbx · 1.5% likely

   CWE-22

2. In FusionPBX up to v4.5.7, the file resources\download.php uses an unsanitized "f" variable coming from the URL, which takes any pathname and allows a download of it. (resources\s…CVE-2019-16986Fusionpbx · 1.4% likely

   CWE-22

3. In FusionPBX up to v4.5.7, the file app/music_on_hold/music_on_hold.php uses an unsanitized "file" variable coming from the URL, which takes any pathname (base64 encoded) and allo…CVE-2019-16990Fusionpbx · 1.3% likely

   CWE-22

4. A Directory Traversal vulnerability exists in FusionPBX 4.5.7 allows malicoius users to rename any file of the system.via the (1) folder, (2) filename, and (3) newfilename variabl…CVE-2020-21055Fusionpbx · 1.2% likely

   CWE-22

5. In FusionPBX up to v4.5.7, the file app\xml_cdr\xml_cdr_delete.php uses an unsanitized "rec" variable coming from the URL, which is base64 decoded and allows deletion of any file…CVE-2019-16985Fusionpbx · 1.1% likely

   CWE-22

6. Directory Traversal vulnerability exists in FusionPBX 4.5.7, which allows a remote malicious user to create folders via the folder variale to app\edit\foldernew.php.CVE-2020-21056Fusionpbx · 1.0% likely

   CWE-22

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.