Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.5.2 and 2.6.0rc2, and possibly other versions, allow remote attackers to inject arbitrary web script or HTML via the (1) tech parameter to admin/admin/config.php during a trunks display action, the (2) description parameter during an Add Zap Channel action, and (3) unspecified vectors during an Add Recordings action.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
FreePBX 多个跨站脚本漏洞
Vulnerability Description
FreePBX（前称Asterisk Management Portal）是FreePBX项目的一套通过GUI（基于网页的图形化接口）配置Asterisk（IP电话系统）的工具。 当display设置为trunks的时候，FreePBX没有正确地过滤提交给admin/config.php的tech参数便返回给了用户，这可能导致在用户的浏览器会话中执行任意HTML和脚本代码。此外在添加Zap渠道的时候没有正确的过滤提交给Description部分的输入，这可能导致存储式跨站脚本攻击。
CVSS Information
N/A
Vulnerability Type
N/A