CVE-2021-37524

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross Site Scripting (XSS) vulnerability in FusionPBX 4.5.26 allows remote unauthenticated users to inject arbitrary web script or HTML via an unsanitized "path" parameter in resources/login.php.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/fusionpbx/fusionpbx/commit/c3b811393de63e324eaa64fe5c9ea3fce428fe1aPatch, Third Party Advisory
https://www.fusionpbx.com/app/tickets/ticket_edit.php?id=4a0666cd-8c12-46ae-bc0a-02f007b62cdbPermissions Required, Vendor Advisory
https://github.com/fusionpbx/fusionpbx/commit/c3b811393de63e324eaa64fe5c9ea3fce428fe1aPatch, Third Party Advisory
https://www.fusionpbx.com/app/tickets/ticket_edit.php?id=4a0666cd-8c12-46ae-bc0a-02f007b62cdbPermissions Required, Vendor Advisory

Timeline

Published: Jul 1, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-375295.5A double-free vulnerability exists in fig2dev through 3.28a is affected by: via the free_stream function in readpics.c, which could cause a CVE-2021-37534.7A race problem was seen in the vt_k_ioctl in drivers/tty/vt/vt_ioctl.c in the Linux kernel, which may cause an out of bounds read in vt as t CVE-2021-375305.5A denial of service vulnerabiity exists in fig2dev through 3.28a due to a segfault in the open_stream function in readpics.c.CVE-2021-375318.8SAP NetWeaver Knowledge Management XML Forms versions - 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, contains an XSLT vulnerability which allows a no CVE-2021-375324.3SAP Business One version - 10, due to improper input validation, allows an authenticated User to gain access to directory and view the conte CVE-2021-375336.5Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commo CVE-2021-375345.4app/View/GalaxyClusters/add.ctp in MISP 2.4.146 allows Stored XSS when forking a galaxy cluster.CVE-2021-375359.8SAP NetWeaver Application Server Java (JMS Connector Service) - versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform necessary auth CVE-2021-375389.8Multiple SQL injection vulnerabilities in SmartDataSoft SmartBlog for PrestaShop before 4.06 allow a remote unauthenticated attacker to exec CVE-2021-375399.8Zoho ManageEngine ADManager Plus before 7111 is vulnerable to unrestricted file which leads to Remote code execution.CVE-2021-37545.3A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. This CVE-2021-375406.5In JetBrains Hub before 2021.1.13262, a potentially insufficient CSP for the Widget deployment feature was used.