Cross-site Scripting

Every one of the 32 is a mark on the map. Named now: 1 to 26, most at risk first.

1. XSS in app/operator_panel/index_inc.php in the Operator Panel module in FusionPBX 4.4.3 allows remote unauthenticated attackers to inject arbitrary JavaScript characters by placin…CVE-2019-11408Fusionpbx · 6.9% likely

   CWE-79

2. A cross-site scripting (XSS) vulnerability in app/dialplans/dialplan_detail_edit.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the dial…CVE-2019-19388Fusionpbx · 0.9% likely

   CWE-79

3. A cross-site scripting (XSS) vulnerability in app/fifo_list/fifo_interactive.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the c parame…CVE-2019-19387Fusionpbx · 0.9% likely

   CWE-79

4. A cross-site scripting (XSS) vulnerability in app/voicemail_greetings/voicemail_greeting_edit.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML…CVE-2019-19386Fusionpbx · 0.9% likely

   CWE-79

5. A cross-site scripting (XSS) vulnerability in app/dialplans/dialplans.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the app_uuid parame…CVE-2019-19385Fusionpbx · 0.9% likely

   CWE-79

6. A cross-site scripting (XSS) vulnerability in app/fax/fax_log_view.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the fax_uuid parameter.CVE-2019-19384Fusionpbx · 0.9% likely

   CWE-79

7. A cross-site scripting (XSS) vulnerability in app/fax/fax_files.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter.CVE-2019-19367Fusionpbx · 0.9% likely

   CWE-79

8. A cross-site scripting (XSS) vulnerability in app/xml_cdr/xml_cdr_search.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the redirect par…CVE-2019-19366Fusionpbx · 0.9% likely

   CWE-79

9. In FusionPBX up to v4.5.7, the file app\devices\device_settings.php uses an unsanitized "id" variable coming from the URL, which is reflected on 2 occasions in HTML, leading to XS…CVE-2019-16978Fusionpbx · 0.9% likely

   CWE-79

10. In FusionPBX up to 4.5.7, the file app\contacts\contact_addresses.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS.CVE-2019-16972Fusionpbx · 0.8% likely

    CWE-79

11. In FusionPBX up to v4.5.7, the file app\contacts\contact_import.php uses an unsanitized "query_string" variable coming from the URL, which is reflected in HTML, leading to XSS.CVE-2019-16987Fusionpbx · 0.8% likely

    CWE-79

12. In FusionPBX up to v4.5.7, the file app\contacts\contact_urls.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS.CVE-2019-16979Fusionpbx · 0.8% likely

    CWE-79

13. In FusionPBX up to 4.5.7, the file app\contacts\contact_times.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS.CVE-2019-16974Fusionpbx · 0.8% likely

    CWE-79

14. In FusionPBX up to 4.5.7, the file app\contacts\contact_edit.php uses an unsanitized "query_string" variable coming from the URL, which is reflected in HTML, leading to XSS.CVE-2019-16973Fusionpbx · 0.8% likely

    CWE-79

15. An issue was discovered in FusionPBX up to 4.5.7. In the file app\conference_controls\conference_control_details.php, an unsanitized id variable coming from the URL is reflected i…CVE-2019-16968Fusionpbx · 0.8% likely

    CWE-79

16. In FusionPBX up to v4.5.7, the file app\edit\filedelete.php uses an unsanitized "file" variable coming from the URL, which is reflected in HTML, leading to XSS.CVE-2019-16991Fusionpbx · 0.8% likely

    CWE-79

17. In FusionPBX up to v4.5.7, the file app\conferences_active\conference_interactive.php uses an unsanitized "c" variable coming from the URL, which is reflected in HTML, leading to…CVE-2019-16989Fusionpbx · 0.8% likely

    CWE-79

18. In FusionPBX up to v4.5.7, the file app\basic_operator_panel\resources\content.php uses an unsanitized "eavesdrop_dest" variable coming from the URL, which is reflected on 3 occas…CVE-2019-16988Fusionpbx · 0.8% likely

    CWE-79

19. In FusionPBX up to v4.5.7, the file app\recordings\recording_play.php uses an unsanitized "filename" variable coming from the URL, which is base64 decoded and reflected in HTML, l…CVE-2019-16984Fusionpbx · 0.8% likely

    CWE-79

20. In FusionPBX up to v4.5.7, the file resources\paging.php has a paging function (called by several pages of the interface), which uses an unsanitized "param" variable constructed p…CVE-2019-16983Fusionpbx · 0.8% likely

    CWE-79

21. In FusionPBX up to v4.5.7, the file app\access_controls\access_control_nodes.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS.CVE-2019-16982Fusionpbx · 0.8% likely

    CWE-79

22. In FusionPBX up to v4.5.7, the file app\conference_profiles\conference_profile_params.php uses an unsanitized "id" variable coming from the URL, which is reflected on 2 occasions…CVE-2019-16981Fusionpbx · 0.8% likely

    CWE-79

23. In FusionPBX up to 4.5.7, the file app\messages\messages_thread.php uses an unsanitized "contact_uuid" variable coming from the URL, which is reflected on 3 occasions in HTML, lea…CVE-2019-16971Fusionpbx · 0.8% likely

    CWE-79

24. In FusionPBX up to 4.5.7, the file app\sip_status\sip_status.php uses an unsanitized "savemsg" variable coming from the URL, which is reflected in HTML, leading to XSS.CVE-2019-16970Fusionpbx · 0.8% likely

    CWE-79

25. In FusionPBX up to 4.5.7, the file app\fifo_list\fifo_interactive.php uses an unsanitized "c" variable coming from the URL, which is reflected in HTML, leading to XSS.CVE-2019-16969Fusionpbx · 0.8% likely

    CWE-79

26. Cross Site Scripting (XSS) vulnerability in FusionPBX 4.5.26 allows remote unauthenticated users to inject arbitrary web script or HTML via an unsanitized "path" parameter in reso…CVE-2021-37524Fusionpbx · 0.8% likely

    CWE-79

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.