Vulnerabilities

TI-2026-08424 CVE-2026-9588 · GHSA-xrh4-q49w-whmw

Authenticated Stored Cross-Site Scripting (XSS) in Switchvox SMB Web Portal

LOW 31

A stored cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997) within the voicemail notification template functionality.

CVSS 4.0HIGH 7.0 Network Low privileges User interaction EPSS 0.00405 Published 2026-07-17 Fixed in 8.4.0.2 CWE-79

TI-2026-08423 CVE-2026-9587 · GHSA-25gv-rxp9-h9pc

Authenticated Local File Inclusion (LFI) in Switchvox SMB Web Portal

LOW 31

An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997).

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00378 Published 2026-07-17 Fixed in 8.4.0.2 CWE-73

TI-2026-08422 CVE-2026-9586 · GHSA-m32j-v93f-gfgc

Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB

CRITICAL 99KEV

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997).

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.18979 Published 2026-07-17 Fixed in 8.4.0.2 CWE-89

TI-2026-08421 CVE-2026-9585 · GHSA-34c9-mcf5-3rp3

Unauthenticated Reflected Cross-Site Scripting (XSS) in Switchvox SMB Web Portal

MEDIUM 40

An unauthenticated reflected cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition version 8.3 (104997).

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00554 Published 2026-07-17 Fixed in 8.4.0.2 CWE-79

Vulnerabilities

Filters

Authenticated Stored Cross-Site Scripting (XSS) in Switchvox SMB Web Portal

Authenticated Local File Inclusion (LFI) in Switchvox SMB Web Portal

Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB

Unauthenticated Reflected Cross-Site Scripting (XSS) in Switchvox SMB Web Portal