CVE-2019-14935

3CX Phone 15 on Windows has insecure permissions on the "%PROGRAMDATA%\3CXPhone for Windows\PhoneApp" installation directory, allowing Full Control access for Everyone, and leading to privilege escalation because of a StartUp link.

• CWE-732

• https://www.3cx.com/community/threads/security-issue-with-3cx-windows-client-install.64432/Exploit, Issue Tracking, Vendor Advisory
• https://www.3cx.com/community/threads/security-issue-with-3cx-windows-client-install.64432/Exploit, Issue Tracking, Vendor Advisory

Published

Aug 12, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1493Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-14930An issue was discovered on Mitsubishi Electric Europe B.V. M…9.8
• CVE-2019-14931An issue was discovered on Mitsubishi Electric Europe B.V. M…9.8
• CVE-2019-14932The Recruitment module in Humanica Humatrix 7 1.0.0.681 and …
• CVE-2019-14933Bagisto 0.1.5 allows CSRF under /admin URIs.
• CVE-2019-14934An issue was discovered in PDFResurrect before 0.18. pdf_loa…7.8
• CVE-2019-14936Easy!Appointments 1.3.2 plugin for WordPress allows Sensitiv…5.3
• CVE-2019-14937REDCap before 9.3.0 allows time-based SQL injection in the e…
• CVE-2019-14939An issue was discovered in the mysql (aka mysqljs) module 2.…
• CVE-2019-1494Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-14940In Storage Performance Development Kit (SPDK) before 19.07, …
• CVE-2019-14941SHAREit through 4.0.6.177 does not check the body length fro…7.5