VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Oct 21, 2019· Updated Jun 17, 2026

CVE-2019-16966

CVE-2019-16966

Description

An issue was discovered in Contactmanager 13.x before 13.0.45.3, 14.x before 14.0.5.12, and 15.x before 15.0.8.21 for FreePBX 14.0.10.3. In the Contactmanager class (html\admin\modules\contactmanager\Contactmanager.class.php), an unsanitized group variable coming from the URL is reflected in HTML on 2 occasions, leading to XSS. It can be requested via a GET request to /admin/ajax.php?module=contactmanager.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

15
  • Freepbx/Contactmanager13 versions
    cpe:2.3:a:freepbx:contactmanager:*:*:*:*:*:freepbx:*:*+ 12 more
    • cpe:2.3:a:freepbx:contactmanager:*:*:*:*:*:freepbx:*:*range: >=13.0.2,<13.0.45.3
    • cpe:2.3:a:freepbx:contactmanager:13.0.0:beta1:*:*:*:freepbx:*:*
    • cpe:2.3:a:freepbx:contactmanager:13.0.0:beta2:*:*:*:freepbx:*:*
    • cpe:2.3:a:freepbx:contactmanager:13.0.0:beta3:*:*:*:freepbx:*:*
    • cpe:2.3:a:freepbx:contactmanager:13.0.0:beta4:*:*:*:freepbx:*:*
    • cpe:2.3:a:freepbx:contactmanager:13.0.0:beta5:*:*:*:freepbx:*:*
    • cpe:2.3:a:freepbx:contactmanager:14.0.1:-:*:*:*:freepbx:*:*
    • cpe:2.3:a:freepbx:contactmanager:14.0.1:alpha1:*:*:*:freepbx:*:*
    • cpe:2.3:a:freepbx:contactmanager:14.0.1:alpha2:*:*:*:freepbx:*:*
    • cpe:2.3:a:freepbx:contactmanager:14.0.1:beta1:*:*:*:freepbx:*:*
    • cpe:2.3:a:freepbx:contactmanager:14.0.1:beta2:*:*:*:freepbx:*:*
    • cpe:2.3:a:freepbx:contactmanager:14.0.1:beta3:*:*:*:freepbx:*:*
    • (no CPE)range: <13.0.45.3, <14.0.5.12, <15.0.8.21
  • Freepbx/Freepbx
    cpe:2.3:a:sangoma:freepbx:14.0.10.3:*:*:*:*:*:*:*
  • FreePBX/Contactmanagerdescription

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.