TI-2024-00909 CVE-2024-0986 · GHSA-v9pc-9fc9-4ff8
Issabel PBX Asterisk-Cli os command injection
Priority HIGH 76
A vulnerability was found in Issabel PBX 4.0.0.
Issabel
Records12All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9
Exploited now
Issabel records in CISA KEVNo Issabel vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
12 records in Pbx · all components
TI-2023-19184 CVE-2023-37599 · GHSA-wxp7-94m7-556q
An issue in issabel-pbx v.4.0.0-6 allows a remote attacker to obtain sensitive information via the modules directory
Priority HIGH 72
An issue in issabel-pbx v.4.0.0-6 allows a remote attacker to obtain sensitive information via the modules directory
TI-2023-19182 CVE-2023-37597 · GHSA-x75m-p9g7-873h
Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote…
Priority HIGH 70
Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial of service via the delete user grouplist function.
TI-2023-19181 CVE-2023-37596 · GHSA-rvhj-5924-5633
Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote…
Priority HIGH 70
Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial of service via a crafted script to the deleteuser function.
TI-2023-17410 CVE-2023-34839 · GHSA-j2pm-wg92-65rc
A Cross Site Request Forgery (CSRF) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows…
Priority HIGH 65
A Cross Site Request Forgery (CSRF) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows a remote attacker to gain privileges via a Custom CSRF exploit to create new user function in the application.
TI-2023-18825 CVE-2023-37191 · GHSA-4qc6-2rm7-vx7r
A stored cross-site scripting (XSS) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows…
Priority MEDIUM 55
A stored cross-site scripting (XSS) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Group and Description parameters.
TI-2023-18824 CVE-2023-37190 · GHSA-gc4p-x49g-c3h3
A stored cross-site scripting (XSS) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows…
Priority MEDIUM 55
A stored cross-site scripting (XSS) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Virtual Fax Name and Caller ID Name par…
TI-2023-18823 CVE-2023-37189 · GHSA-h3cv-ph2c-8x5w
A stored cross site scripting (XSS) vulnerability in index.php?menu=billing_rates of…
Priority MEDIUM 55
A stored cross site scripting (XSS) vulnerability in index.php?menu=billing_rates of Issabel PBX version 4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the Name or Prefix f…
TI-2023-19183 CVE-2023-37598 · GHSA-2gq6-2xmm-47p4
A Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a…
Priority MEDIUM 54
A Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial of service via the delete new virtual fax function.
TI-2021-19527 CVE-2021-43695 · GHSA-42vq-32v8-j5v7
issabelPBX version 2.11 is affected by a Cross Site Scripting (XSS) vulnerability.
Priority LOW 28
issabelPBX version 2.11 is affected by a Cross Site Scripting (XSS) vulnerability.
TI-2021-21330 CVE-2021-46558 · GHSA-mq49-c9jr-f8ch
Multiple cross-site scripting (XSS) vulnerabilities in the Add User module of Issabel PBX…
Priority LOW 25
Multiple cross-site scripting (XSS) vulnerabilities in the Add User module of Issabel PBX 20200102 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the username and password f…
TI-2021-13305 CVE-2021-34190 · GHSA-8p87-gj5p-jx33
A stored cross site scripting (XSS) vulnerability in index.php?menu=billing_rates of…
Priority LOW 23
A stored cross site scripting (XSS) vulnerability in index.php?menu=billing_rates of Issabel PBX version 4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Name" or "Prefi…