CVE-2009-4458

2009-12-3000:00:00

mitre

www.cve.org

5.8 Medium

AI Score

Confidence

High

0.079 Low

EPSS

Percentile

94.3%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.5.2 and 2.6.0rc2, and possibly other versions, allow remote attackers to inject arbitrary web script or HTML via the (1) tech parameter to admin/admin/config.php during a trunks display action, the (2) description parameter during an Add Zap Channel action, and (3) unspecified vectors during an Add Recordings action.