CVE-2021-43695

issabelPBX version 2.11 is affected by a Cross Site Scripting (XSS) vulnerability. In file page.backup_restore.php, the exit function will terminate the script and print the message to the user. The message will contain $_REQUEST without sanitization, then there is a XSS vulnerability.

• CWE-79

• https://github.com/IssabelFoundation/issabelPBX/issues/33Exploit, Issue Tracking, Third Party Advisory
• https://github.com/IssabelFoundation/issabelPBX/issues/33Exploit, Issue Tracking, Third Party Advisory

Published

Nov 29, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43689manage (last update Oct 24, 2017) is affected by a Cross Sit…6.1
• CVE-2021-4369The Frontend File Manager plugin for WordPress is vulnerable…5.3
• CVE-2021-43690YurunProxy v0.01 is affected by a Cross Site Scripting (XSS)…6.1
• CVE-2021-43691tripexpress v1.1 is affected by a path manipulation vulnerab…9.8
• CVE-2021-43692youtube-php-mirroring (last update Jun 9, 2017) is affected …6.1
• CVE-2021-43693vesta 0.9.8-24 is affected by a file inclusion vulnerability…9.8
• CVE-2021-43696twmap v2.91_v4.33 is affected by a Cross Site Scripting (XSS…6.1
• CVE-2021-43697Workerman-ThinkPHP-Redis (last update Mar 16, 2018) is affec…6.1
• CVE-2021-43698phpWhois (last update Jun 30 2021) is affected by a Cross Si…6.1
• CVE-2021-4370The uListing plugin for WordPress is vulnerable to authoriza…9.8
• CVE-2021-43700An issue was discovered in ApiManager 1.1. there is sql inje…9.8
• CVE-2021-43701CSZ CMS 1.2.9 has a Time and Boolean-based Blind SQL Injecti…6.5