High severity7.2NVD Advisory· Published Oct 21, 2019· Updated Jun 17, 2026

CVE-2019-16965

Description

resources/cmd.php in FusionPBX up to 4.5.7 suffers from a command injection vulnerability due to a lack of input validation, which allows authenticated administrative attackers to execute any commands on the host as www-data.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

FusionPBX/FusionPBX2 versions
cpe:2.3:a:fusionpbx:fusionpbx:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:fusionpbx:fusionpbx:*:*:*:*:*:*:*:*range: <=4.5.7
- (no CPE)range: <=4.5.7
FusionPBX/FusionPBXdescription

Patches

Vulnerability mechanics

References

github.com/fusionpbx/fusionpbx/commit/6baad9af1bc55c80b793af3bd1ac35b39c20b173nvdThird Party Advisory
resp3ctblog.wordpress.com/2019/10/19/fusionpbx-sofia-api-command-injection-2/nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.468
epss	0.002
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000