Skip to content
Threat Feed
Subscribe

Product

FusionPBX (<= 5.6.5)

1 brief RSS
high advisory

FusionPBX OS Command Injection via Malicious Caller-ID

FusionPBX versions up to 5.6.5 contain an unauthenticated OS command injection vulnerability in the call_recordings::download function, allowing arbitrary code execution via crafted Caller-ID fields.

FusionPBX remote-code-execution command-injection web-application
2t 1c