Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

12 records

Vendor: VICIdial Clear all filters
TI-2024-07884 CVE-2024-8504 · GHSA-r47m-g4vh-pxf6

VICIdial Authenticated Remote Code Execution

Priority HIGH 79

An attacker with authenticated access to VICIdial as an "agent" can execute arbitrary shell commands as the "root" user.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.76217 Published 2024-09-10 No fix listed CWE-78
TI-2024-07883 CVE-2024-8503 · GHSA-5qf6-wqm9-p35x

VICIdial Unauthenticated SQL Injection

Priority CRITICAL 89

An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.79274 Published 2024-09-10 No fix listed CWE-89
TI-2022-15676 CVE-2022-34879 · GHSA-4gg9-66fr-r99m

Cross-site scripting in VICIdial

Priority LOW 30

Reflected Cross Site Scripting (XSS) vulnerabilities in AST Agent Time Sheet interface (/vicidial/AST_agent_time_sheet.php) of VICIdial via agent, and search_archived_data parameters.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00535 Published 2022-07-05 Fixed in 3555 CWE-79
TI-2022-15675 CVE-2022-34878 · GHSA-ffxp-v57g-86fj

VICIDial 2.14b0.5 SVN 3550 was discovered to contain a SQL injection vulnerability at /vicidial/user_stats.php.

Priority MEDIUM 44

SQL Injection vulnerability in User Stats interface (/vicidial/user_stats.php) of VICIdial via the file_download parameter allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of al…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0336 Published 2022-07-05 Fixed in 3555 CWE-89
TI-2022-15674 CVE-2022-34877 · GHSA-5mpj-2x3p-rv6q

SQL injection in VICIdial

Priority MEDIUM 44

SQL Injection vulnerability in AST Agent Time Sheet interface ((/vicidial/AST_agent_time_sheet.php) of VICIdial via the agent parameter allows attacker to spoof identity, tamper with existing data, allow the complete dis…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.03388 Published 2022-07-05 Fixed in 3555 CWE-89
TI-2022-15673 CVE-2022-34876 · GHSA-vm9r-p8vp-v2fj

VICIDial 2.14b0.5 SVN 3550 was discovered to contain multiple SQL injection vulnerability at /vicidial/admin.php.

Priority MEDIUM 44

SQL Injection vulnerability in admin interface (/vicidial/admin.php) of VICIdial via modify_email_accounts, access_recordings, and agentcall_email parameters allows attacker to spoof identity, tamper with existing data,…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.03449 Published 2022-07-05 Fixed in 3555 CWE-89
TI-2013-03917 CVE-2013-4468 · GHSA-ghf9-5r8c-4qx7

VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and earlier allows…

Priority MEDIUM 53

VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and earlier allows remote authenticated users to execute arbitrary commands via shell metacharacters in the extension parameter in an OriginateVDRelogin ac…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.32286 Published 2014-05-14 No fix listed
TI-2013-03916 CVE-2013-4467 · GHSA-chff-9v4g-4m28

Multiple SQL injection vulnerabilities in the agent interface (agc/) in VICIDIAL dialer…

Priority MEDIUM 53

Multiple SQL injection vulnerabilities in the agent interface (agc/) in VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and earlier allow (1) remote attackers to execute arbitrary SQL commands via the ca…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.30628 Published 2014-03-11 No fix listed CWE-89
TI-2009-02141 CVE-2009-2234 · GHSA-8989-85q8-3j83

Multiple SQL injection vulnerabilities in admin.php in VICIDIAL Call Center Suite…

Priority LOW 35

Multiple SQL injection vulnerabilities in admin.php in VICIDIAL Call Center Suite 2.0.5-173 allow remote attackers to execute arbitrary SQL commands via the (1) Username parameter ($PHP_AUTH_USER) and (2) Password parame…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01027 Published 2009-06-27 No fix listed CWE-89