TI-2023-00454 CVE-2023-0480 · GHSA-wv94-3wc8-85h3
Cross-site request forgery in VitalPBX
Priority HIGH 73
VitalPBX version 3.2.3-8 allows an unauthenticated external attacker to obtain the instance administrator's account.
Vitalpbx
Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
Vitalpbx records in CISA KEVNo Vitalpbx vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
4 records
TI-2024-16099 CVE-2024-24386 · GHSA-75qr-hmmv-f5vx
An issue in VitalPBX v.3.2.4-5 allows an attacker to execute arbitrary code via a crafted…
Priority HIGH 67
An issue in VitalPBX v.3.2.4-5 allows an attacker to execute arbitrary code via a crafted payload to the /var/lib/vitalpbx/scripts folder.
TI-2023-00460 CVE-2023-0486 · GHSA-4x5j-gwp5-7hgh
Cross-site scripting in VitalPBX
Priority MEDIUM 60
VitalPBX version 3.2.3-8 allows an unauthenticated external attacker to obtain the instance's administrator account via a malicious link.
TI-2022-11841 CVE-2022-29330 · GHSA-rhr8-8xj2-r4pc
Missing access control in the backup system of Telesoft VitalPBX before 3.2.1 allows…
Priority LOW 24
Missing access control in the backup system of Telesoft VitalPBX before 3.2.1 allows attackers to access the PJSIP and SIP extension credentials, cryptographic keys and voicemails files via unspecified vectors.