Read the docs

VICIdial

Records12All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9

Exploited now

VICIdial records in CISA KEV

No VICIdial vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Vicidial 9 records MEDIUM Call Center Suite 1 record LOW

Records

12 records

TI-2024-07883 CVE-2024-8503 · GHSA-5qf6-wqm9-p35x

VICIdial Unauthenticated SQL Injection

Priority CRITICAL 89

An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.79274 Published 2024-09-10 No fix listed CWE-89
TI-2024-07884 CVE-2024-8504 · GHSA-r47m-g4vh-pxf6

VICIdial Authenticated Remote Code Execution

Priority HIGH 79

An attacker with authenticated access to VICIdial as an "agent" can execute arbitrary shell commands as the "root" user.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.76217 Published 2024-09-10 No fix listed CWE-78
TI-2013-03917 CVE-2013-4468 · GHSA-ghf9-5r8c-4qx7

VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and earlier allows…

Priority MEDIUM 53

VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and earlier allows remote authenticated users to execute arbitrary commands via shell metacharacters in the extension parameter in an OriginateVDRelogin ac…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.32286 Published 2014-05-14 No fix listed
TI-2013-03916 CVE-2013-4467 · GHSA-chff-9v4g-4m28

Multiple SQL injection vulnerabilities in the agent interface (agc/) in VICIDIAL dialer…

Priority MEDIUM 53

Multiple SQL injection vulnerabilities in the agent interface (agc/) in VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and earlier allow (1) remote attackers to execute arbitrary SQL commands via the ca…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.31393 Published 2014-03-11 No fix listed CWE-89
TI-2022-15675 CVE-2022-34878 · GHSA-ffxp-v57g-86fj

VICIDial 2.14b0.5 SVN 3550 was discovered to contain a SQL injection vulnerability at /vicidial/user_stats.php.

Priority MEDIUM 44

SQL Injection vulnerability in User Stats interface (/vicidial/user_stats.php) of VICIdial via the file_download parameter allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of al…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0336 Published 2022-07-05 Fixed in 3555 CWE-89
TI-2022-15674 CVE-2022-34877 · GHSA-5mpj-2x3p-rv6q

SQL injection in VICIdial

Priority MEDIUM 44

SQL Injection vulnerability in AST Agent Time Sheet interface ((/vicidial/AST_agent_time_sheet.php) of VICIdial via the agent parameter allows attacker to spoof identity, tamper with existing data, allow the complete dis…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.03388 Published 2022-07-05 Fixed in 3555 CWE-89
TI-2022-15673 CVE-2022-34876 · GHSA-vm9r-p8vp-v2fj

VICIDial 2.14b0.5 SVN 3550 was discovered to contain multiple SQL injection vulnerability at /vicidial/admin.php.

Priority MEDIUM 44

SQL Injection vulnerability in admin interface (/vicidial/admin.php) of VICIdial via modify_email_accounts, access_recordings, and agentcall_email parameters allows attacker to spoof identity, tamper with existing data,…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.03449 Published 2022-07-05 Fixed in 3555 CWE-89
TI-2009-02141 CVE-2009-2234 · GHSA-8989-85q8-3j83

Multiple SQL injection vulnerabilities in admin.php in VICIDIAL Call Center Suite…

Priority LOW 35

Multiple SQL injection vulnerabilities in admin.php in VICIDIAL Call Center Suite 2.0.5-173 allow remote attackers to execute arbitrary SQL commands via the (1) Username parameter ($PHP_AUTH_USER) and (2) Password parame…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01027 Published 2009-06-27 No fix listed CWE-89
TI-2022-15676 CVE-2022-34879 · GHSA-4gg9-66fr-r99m

Cross-site scripting in VICIdial

Priority LOW 30

Reflected Cross Site Scripting (XSS) vulnerabilities in AST Agent Time Sheet interface (/vicidial/AST_agent_time_sheet.php) of VICIdial via agent, and search_archived_data parameters.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00535 Published 2022-07-05 Fixed in 3555 CWE-79
Open these records in search →