漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
FreePBX UCP is Vulnerable to Stored XSS Through its User Control Panel
Vulnerability Description
contactmanager is a module for FreePBX@, which is an open source GUI that controls and manages Asterisk© (PBX). In versions 15.0.14 and below, 16.0.0 through 16.0.26.4 and 17.0.0 through 17.0.5, a stored cross-site scripting (XSS) vulnerability in FreePBX allows a low-privileged User Control Panel (UCP) user to inject malicious JavaScript into the system. The malicious code executes in the context of an administrator when they interact with the affected component, leading to session hijacking and potential privilege escalation. This issue is fixed in versions 15.0.14, 16.0.27 and 17.0.6.
CVSS Information
N/A
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Vulnerability Title
FreePBX 跨站脚本漏洞
Vulnerability Description
FreePBX（前称Asterisk Management Portal）是FreePBX项目的一套通过GUI（基于网页的图形化接口）配置Asterisk（IP电话系统）的工具。 FreePBX contactmanager存在跨站脚本漏洞，该漏洞源于存储型跨站脚本漏洞可能导致会话劫持和权限提升。以下版本受到影响：15.0.14及之前版本、16.0.0至16.0.26.4版本和17.0.0至17.0.5版本。
CVSS Information
N/A
Vulnerability Type
N/A