3cx vulnerabilities

Products

• Live Chat 13
• 3cx 12
• Web Server 3
• Phone System 3
• Phone System Firmware 2

Newest

• 3cx 3CX Uncontrolled Search Path Local Privilege Escalation Vulnerability CVE-2023-27362 7.0 HighMay 3, 2024
• 3cx The CRM Integration in 3CX before 18.0.9.23 and 20 before 20.0.0.1494 allows SQL Injection via a... CVE-2023-49954 Public exploit 9.8 CriticalDecember 25, 2023
• 3cx 3CX before 18 Hotfix 1 build 18.0.3.461 on Windows allows unauthenticated remote attackers to... CVE-2022-48483 7.5 HighMay 2, 2023
• 3cx 3CX before 18 Update 2 Security Hotfix build 18.0.2.315 on Windows allows unauthenticated remote... CVE-2022-48482 7.5 HighMay 2, 2023
• 3cx 3CX DesktopApp through 18.12.416 has embedded malicious code, as exploited in the wild in March... CVE-2023-29059 7.8 HighMarch 30, 2023
• 3cx phone system firmware, debian linux +1 more PhoneSystem Terminal in 3CX Phone System (Debian based installation) 16.0.0.1570 allows an... CVE-2019-9972 8.8 HighJune 7, 2022
• 3cx phone system firmware, debian linux +1 more PhoneSystem Terminal in 3CX Phone System (Debian based installation) 16.0.0.1570 allows an... CVE-2019-9971 8.8 HighJune 7, 2022
• caphyon advanced installer, 3cx call flow designer, crm template generator +67 more +69 more Caphyon Ltd Advanced Installer 19.2 was discovered to contain a remote code execution (RCE)... CVE-2022-27438 Public exploit 8.1 HighJune 6, 2022
• 3cx An issue was discovered in the 3CX Phone System Management Console prior to version 18 Update 3... CVE-2022-28005 9.8 CriticalMay 6, 2022
• 3cx 3CX System through 2022-03-17 stores cleartext passwords in a database. CVE-2021-45491 6.5 MediumMarch 28, 2022
• 3cx The client applications in 3CX on Windows, the 3CX app for iOS, and the 3CX application for... CVE-2021-45490 9.1 CriticalMarch 28, 2022
• 3cx live chat The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls... CVE-2019-12498 9.8 CriticalMarch 20, 2020
• 3cx live chat The wp-live-chat-support plugin before 4.1.0 for WordPress has JavaScript injections. CVE-2014-10386 6.1 MediumAugust 22, 2019
• 3cx live chat The wp-live-chat-support plugin before 7.1.05 for WordPress has XSS. CVE-2017-18507 6.1 MediumAugust 13, 2019
• 3cx live chat The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page. CVE-2019-14950 6.1 MediumAugust 12, 2019
• 3cx live chat The wp-live-chat-support plugin before 7.1.03 for WordPress has XSS. CVE-2017-18508 6.1 MediumAugust 12, 2019
• 3cx live chat The wp-live-chat-support plugin before 6.2.02 for WordPress has XSS. CVE-2016-10879 6.1 MediumAugust 12, 2019
• 3cx 3CX Phone 15 on Windows has insecure permissions on the "%PROGRAMDATA%\3CXPhone for Windows... CVE-2019-14935 7.8 HighAugust 11, 2019
• 3cx An issue was discovered in the 3CX Phone system (web) management console 12.5.44178.1002 through... CVE-2019-13176 7.5 HighAugust 8, 2019
• 3cx live chat The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file... CVE-2019-11185 9.8 CriticalJune 3, 2019
• 3cx live chat The wp-live-chat-support plugin before 8.0.18 for WordPress has wp-admin/admin.php?page... CVE-2019-9913 6.1 MediumMarch 21, 2019
• 3cx live chat XSS exists in the wp-live-chat-support v8.0.15 plugin for WordPress via the modules/gdpr.php term... CVE-2018-18460 6.1 MediumOctober 18, 2018
• 3cx web server The Web server in 3CX version 15.5.8801.3 is vulnerable to Information Leakage, because of... CVE-2018-14907 5.3 MediumAugust 3, 2018
• 3cx web server The Web server in 3CX version 15.5.8801.3 is vulnerable to Reflected XSS on all stack traces'... CVE-2018-14906 6.1 MediumAugust 3, 2018
• 3cx web server The Web server in 3CX version 15.5.8801.3 is vulnerable to Reflected XSS on the api/CallLog... CVE-2018-14905 6.1 MediumAugust 3, 2018
• 3cx live chat The WP Live Chat Support Pro plugin before 8.0.07 for WordPress is vulnerable to unauthenticated... CVE-2018-12426 9.8 CriticalJuly 2, 2018
• 3cx live chat There is stored cross site scripting in the wp-live-chat-support plugin before 8.0.08 for... CVE-2018-11105 6.1 MediumMay 15, 2018
• 3cx live chat The WP Live Chat Support plugin before 8.0.06 for WordPress has stored XSS via the Name field. CVE-2018-9864 6.1 MediumApril 9, 2018
• 3cx On 3CX 15.5.6354.2 devices, the parameter "file" in the request "/api/RecordingList/download?file... CVE-2018-7654 6.5 MediumMarch 4, 2018
• 3cx In the 3CX Phone System 15.5.3554.1, the Management Console typically listens to port 5001 and is... CVE-2017-15359 Public exploit 6.5 MediumOctober 18, 2017
• 3cx live chat, codecabin wp live chat support +1 more Cross-site scripting vulnerability in WP Live Chat Support prior to version 7.0.07 allows remote... CVE-2017-2187 6.1 MediumJune 9, 2017
• 3cx phone system login.php in 3CX Phone System 6.0.806.0, when 100% disk capacity is reached, allows remote... CVE-2008-6896 5.0 MediumAugust 3, 2009
• 3cx phone system 3CX Phone System 6.0.806.0 allows remote attackers to cause a denial of service (unstable service... CVE-2008-6895 7.8 HighAugust 3, 2009
• 3cx phone system Multiple cross-site scripting (XSS) vulnerabilities in login.php in 3CX Phone System Free Edition... CVE-2008-6894 4.3 MediumAugust 3, 2009