CVE-2019-11408

XSS in app/operator_panel/index_inc.php in the Operator Panel module in FusionPBX 4.4.3 allows remote unauthenticated attackers to inject arbitrary JavaScript characters by placing a phone call using a specially crafted caller ID number. This can further lead to remote code execution by chaining this vulnerability with a command injection vulnerability also present in FusionPBX.

• CWE-79

• http://packetstormsecurity.com/files/153256/FusionPBX-4.4.3-Remote-Command-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://blog.gdssecurity.com/labs/2019/6/7/rce-using-caller-id-multiple-vulnerabilities-in-fusionpbx.htmlExploit, Third Party Advisory
• https://github.com/fusionpbx/fusionpbx/commit/391a23d070f3036d0c7760992f6970b0a76ee4d7Patch, Third Party Advisory
• http://packetstormsecurity.com/files/153256/FusionPBX-4.4.3-Remote-Command-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://blog.gdssecurity.com/labs/2019/6/7/rce-using-caller-id-multiple-vulnerabilities-in-fusionpbx.htmlExploit, Third Party Advisory
• https://github.com/fusionpbx/fusionpbx/commit/391a23d070f3036d0c7760992f6970b0a76ee4d7Patch, Third Party Advisory

Published

Jun 17, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-11402In Gradle Enterprise before 2018.5.3, Build Cache Nodes did …9.8
• CVE-2019-11403In Gradle Enterprise before 2018.5.2, Build Cache Nodes woul…9.8
• CVE-2019-11404arrow-kt Arrow before 0.9.0 resolved Gradle build artifacts …8.1
• CVE-2019-11405OpenAPI Tools OpenAPI Generator before 4.0.0-20190419.052012…8.1
• CVE-2019-11406Subrion CMS 4.2.1 allows _core/en/contacts/ XSS via the name…
• CVE-2019-11407app/operator_panel/index_inc.php in the Operator Panel modul…
• CVE-2019-11409app/operator_panel/exec.php in the Operator Panel module in …8.8
• CVE-2019-1141A remote code execution vulnerability exists in the way that…4.2
• CVE-2019-11410app/backup/index.php in the Backup Module in FusionPBX 4.4.3…
• CVE-2019-11411An issue was discovered in Artifex MuJS 1.0.5. The Number#to…
• CVE-2019-11412An issue was discovered in Artifex MuJS 1.0.5. jscompile.c c…7.5
• CVE-2019-11413An issue was discovered in Artifex MuJS 1.0.5. It has unlimi…