CVE-2009-4458

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

1.85%

Published

Dec 29, 2009

Modified

Apr 22, 2026

Public PoC / Exploit (4)

All weaponized →

TrickestTrickest PoC index Exploit-DBFreePBX 2.5.2 - '/admin/config.php?tech' Cross-Site Scripting Exploit-DBFreePBX 2.5.2 - Zap Channel Addition Description Parameter Cross-Site Scripting Exploit-DBPBX Phone System 2.x - Multiple Vulnerabilities

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.5.2 and 2.6.0rc2, and possibly other versions, allow remote attackers to inject arbitrary web script or HTML via the (1) tech parameter to admin/admin/config.php during a trunks display action, the (2) description parameter during an Add Zap Channel action, and (3) unspecified vectors during an Add Recordings action.

Weaknesses (CWE)

CWE-79

Affected Products (2)

freepbx · freepbxvulnerable

References (14)

http://osvdb.org/61357

http://osvdb.org/61358

http://secunia.com/advisories/37972

Vendor Advisory

http://www.exploit-db.com/exploits/10645

Exploit

http://www.securityfocus.com/bid/37482