CVE-2019-11409

app/operator_panel/exec.php in the Operator Panel module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation that allows authenticated non-administrative attackers to execute commands on the host. This can further lead to remote code execution when combined with an XSS vulnerability also present in the FusionPBX Operator Panel module.

• CWE-78

• http://packetstormsecurity.com/files/153256/FusionPBX-4.4.3-Remote-Command-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/155344/FusionPBX-Operator-Panel-exec.php-Command-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://blog.gdssecurity.com/labs/2019/6/7/rce-using-caller-id-multiple-vulnerabilities-in-fusionpbx.htmlExploit, Third Party Advisory
• https://github.com/fusionpbx/fusionpbx/commit/e43ca27ba2d9c0109a6bf198fe2f8d79f63e0611Patch, Third Party Advisory
• http://packetstormsecurity.com/files/153256/FusionPBX-4.4.3-Remote-Command-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/155344/FusionPBX-Operator-Panel-exec.php-Command-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://blog.gdssecurity.com/labs/2019/6/7/rce-using-caller-id-multiple-vulnerabilities-in-fusionpbx.htmlExploit, Third Party Advisory
• https://github.com/fusionpbx/fusionpbx/commit/e43ca27ba2d9c0109a6bf198fe2f8d79f63e0611Patch, Third Party Advisory

Published

Jun 17, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-11403In Gradle Enterprise before 2018.5.2, Build Cache Nodes woul…9.8
• CVE-2019-11404arrow-kt Arrow before 0.9.0 resolved Gradle build artifacts …8.1
• CVE-2019-11405OpenAPI Tools OpenAPI Generator before 4.0.0-20190419.052012…8.1
• CVE-2019-11406Subrion CMS 4.2.1 allows _core/en/contacts/ XSS via the name…
• CVE-2019-11407app/operator_panel/index_inc.php in the Operator Panel modul…
• CVE-2019-11408XSS in app/operator_panel/index_inc.php in the Operator Pane…
• CVE-2019-1141A remote code execution vulnerability exists in the way that…4.2
• CVE-2019-11410app/backup/index.php in the Backup Module in FusionPBX 4.4.3…
• CVE-2019-11411An issue was discovered in Artifex MuJS 1.0.5. The Number#to…
• CVE-2019-11412An issue was discovered in Artifex MuJS 1.0.5. jscompile.c c…7.5
• CVE-2019-11413An issue was discovered in Artifex MuJS 1.0.5. It has unlimi…
• CVE-2019-11414An issue was discovered on Intelbras IWR 3000N 1.5.0 devices…