Login Request a demo
3C
Product
3cx
by 3cx · last CVE May 3, 2024
12
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities12In the news0Timeline
Severity mix
Critical 3High 6Medium 3Low 0
Severity
All severities12Critical3High6Medium3Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add 3cx to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2023-49954
9.8
2%
Dec 25
The CRM Integration in 3CX before 18.0.9.23 and 20 before 20.0.0.1494 allows SQL Injection via a first name, search string, or email address
Affected: before 18.0.9.23; 20.0 before 20.0.0.1494
CVE-2022-28005
9.8
8%
May 6
An issue was discovered in the 3CX Phone System Management Console prior to version 18 Update 3 FINAL
Affected: through 18.0.3.450
CVE-2021-45490
9.1
1%
Mar 28
The client applications in 3CX on Windows, the 3CX app for iOS, and the 3CX application for Android through 2022-03-17 lack SSL certificate validation
Affected: through 18.0.4; through 18.0.11; through 2022-03-17
CVE-2023-27362
7.8
0%
May 3
3CX Uncontrolled Search Path Local Privilege Escalation Vulnerability
Affected: 18.0.0.451 before 18.0.8.917
CVE-2023-29059
7.8
4%
Mar 30
3CX DesktopApp through 18.12.416 has embedded malicious code, as exploited in the wild in March 2023
Affected: 18.11.1213; 18.12.402; 18.12.407; 18.12.407; 18.12.416; 18.12.416
CVE-2019-14935
7.8
0%
Aug 12
3CX Phone 15 on Windows has insecure permissions on the "%PROGRAMDATA%\3CXPhone for Windows\PhoneApp" installation directory, allowing Full Control access for Everyone, and…
Affected: 15
CVE-2022-48483
7.5
2%
May 2
3CX before 18 Hotfix 1 build 18.0.3.461 on Windows allows unauthenticated remote attackers to read %WINDIR%\system32 files via /Electron/download directory traversal in…
Affected: before 18.0.3.461
CVE-2022-48482
7.5
2%
May 2
3CX before 18 Update 2 Security Hotfix build 18.0.2.315 on Windows allows unauthenticated remote attackers to read certain files via /Electron/download directory traversal
Affected: before 18.0.2.315
CVE-2019-13176
7.5
2%
Aug 8
An issue was discovered in the 3CX Phone system (web) management console 12.5.44178.1002 through 12.5 SP2
Affected: 12.5; 12.5; 12.5.44178.1002
CVE-2021-45491
6.5
1%
Mar 28
3CX System through 2022-03-17 stores cleartext passwords in a database
Affected: through 2022-03-17
CVE-2018-7654
6.5
2%
Mar 4
On 3CX 15.5.6354.2 devices, the parameter "file" in the request "/api/RecordingList/download?file=" allows full access to files on the server via path traversal
Affected: 15.5.6354.2
CVE-2017-15359
6.5
6%
Oct 18
In the 3CX Phone System 15.5.3554.1, the Management Console typically listens to port 5001 and is prone to a directory traversal attack: "/api/RecordingList/DownloadRecord?file="…
Affected: 15.5.3554.1
Showing 12