Fusionpbx

Every one of the 53 is a mark on the map. Named now: 1 to 26, most at risk first.

1. app/operator_panel/exec.php in the Operator Panel module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation that allows authentica…CVE-2019-11409Fusionpbx · 87% likely

   CWE-78

2. An issue was discovered in FusionPBX before 4.5.30. The fax_extension may have risky characters (it is not constrained to be numeric).CVE-2021-43405Fusionpbx · 36% likely
3. FusionPBX 4.4.8 allows an attacker to execute arbitrary system commands by submitting a malicious command to the service_edit.php file (which will insert the malicious command int…CVE-2019-15029Fusionpbx · 12% likely

   CWE-78

4. XSS in app/operator_panel/index_inc.php in the Operator Panel module in FusionPBX 4.4.3 allows remote unauthenticated attackers to inject arbitrary JavaScript characters by placin…CVE-2019-11408Fusionpbx · 6.9% likely

   CWE-79

5. app/backup/index.php in the Backup Module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation, which allows authenticated administr…CVE-2019-11410Fusionpbx · 3.4% likely

   CWE-78

6. resources/cmd.php in FusionPBX up to 4.5.7 suffers from a command injection vulnerability due to a lack of input validation, which allows authenticated administrative attackers to…CVE-2019-16965Fusionpbx · 3.0% likely

   CWE-78

7. app/call_centers/cmd.php in the Call Center Queue Module in FusionPBX up to 4.5.7 suffers from a command injection vulnerability due to a lack of input validation, which allows au…CVE-2019-16964Fusionpbx · 2.0% likely

   CWE-78

8. FusionPBX 5.0.1 was discovered to contain a command injection vulnerability via /fax/fax_send.php.CVE-2022-35153Fusionpbx · 1.9% likely

   CWE-116

9. app/operator_panel/index_inc.php in the Operator Panel module in FusionPBX 4.4.3 suffers from an information disclosure vulnerability due to excessive debug information, which all…CVE-2019-11407Fusionpbx · 1.5% likely

   CWE-200

10. Fusionpbx v4.4 and below contains a command injection vulnerability via the download email logs function.CVE-2022-28055Fusionpbx · 1.5% likely

    CWE-78

11. Directory Traversal vulnerability in FusionPBX 4.5.7, which allows a remote malicious user to delete folders on the system via the folder variable to app/edit/folderdelete.php.CVE-2020-21057Fusionpbx · 1.5% likely

    CWE-22

12. In FusionPBX up to v4.5.7, the file resources\download.php uses an unsanitized "f" variable coming from the URL, which takes any pathname and allows a download of it. (resources\s…CVE-2019-16986Fusionpbx · 1.4% likely

    CWE-22

13. In FusionPBX up to v4.5.7, the file app/music_on_hold/music_on_hold.php uses an unsanitized "file" variable coming from the URL, which takes any pathname (base64 encoded) and allo…CVE-2019-16990Fusionpbx · 1.3% likely

    CWE-22

14. In FusionPBX up to v4.5.7, the file app\call_broadcast\call_broadcast_edit.php uses an unsanitized "id" variable coming from the URL in an unparameterized SQL query, leading to SQ…CVE-2019-16980Fusionpbx · 1.2% likely

    CWE-89

15. A Directory Traversal vulnerability exists in FusionPBX 4.5.7 allows malicoius users to rename any file of the system.via the (1) folder, (2) filename, and (3) newfilename variabl…CVE-2020-21055Fusionpbx · 1.2% likely

    CWE-22

16. In FusionPBX up to v4.5.7, the file app\xml_cdr\xml_cdr_delete.php uses an unsanitized "rec" variable coming from the URL, which is base64 decoded and allows deletion of any file…CVE-2019-16985Fusionpbx · 1.1% likely

    CWE-22

17. FusionPBX through 5.6.5 OS Command Injection via Caller ID in Recording ZIP DownloadCVE-2026-108161fusionpbx · CVSS 7.5 · 1.1% likely

    CWE-78

18. Directory Traversal vulnerability exists in FusionPBX 4.5.7, which allows a remote malicious user to create folders via the folder variale to app\edit\foldernew.php.CVE-2020-21056Fusionpbx · 1.0% likely

    CWE-22

19. An issue was discovered in FusionPBX before 4.5.30. The fax_post_size may have risky characters (it is not constrained to preset values).CVE-2021-43406Fusionpbx · 1.0% likely

    CWE-20

20. An issue was discovered in FusionPBX before 4.5.30. The FAX file name may have risky characters.CVE-2021-43404Fusionpbx · 1.0% likely
21. An issue was discovered in FusionPBX before 4.5.30. The log_viewer.php Log View page allows an authenticated user to choose an arbitrary filename for download (i.e., not necessari…CVE-2021-43403Fusionpbx · 0.9% likely
22. A cross-site scripting (XSS) vulnerability in app/dialplans/dialplan_detail_edit.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the dial…CVE-2019-19388Fusionpbx · 0.9% likely

    CWE-79

23. A cross-site scripting (XSS) vulnerability in app/fifo_list/fifo_interactive.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the c parame…CVE-2019-19387Fusionpbx · 0.9% likely

    CWE-79

24. A cross-site scripting (XSS) vulnerability in app/voicemail_greetings/voicemail_greeting_edit.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML…CVE-2019-19386Fusionpbx · 0.9% likely

    CWE-79

25. A cross-site scripting (XSS) vulnerability in app/dialplans/dialplans.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the app_uuid parame…CVE-2019-19385Fusionpbx · 0.9% likely

    CWE-79

26. A cross-site scripting (XSS) vulnerability in app/fax/fax_log_view.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the fax_uuid parameter.CVE-2019-19384Fusionpbx · 0.9% likely

    CWE-79

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.