Login Request a demo
3C
Vendor
3cx
7 products with CVEs on record
35
CVEs
0
On KEV
0
New 30D
Products
LC
Live Chat
3cx
9.8
13 CVEs0 on KEV0 new
3C
3cx
3cx
9.8
12 CVEs0 on KEV0 new
3W
3cx Web Server
3cx
6.1
3 CVEs0 on KEV0 new
PS
Phone System
3cx
–
3 CVEs0 on KEV0 new
PS
Phone System Firmware
3cx
8.8
2 CVEs0 on KEV0 new
CF
Call Flow Designer
3cx
8.1
1 CVEs0 on KEV0 new
CT
Crm Template Generator
3cx
8.1
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2023-27362
3C
3cx
3cx
7.8
0%
May 33CX Uncontrolled Search Path Local Privilege Escalation Vulnerability
CVE-2023-49954
3C
3cx
3cx
9.8
2%
Dec 25The CRM Integration in 3CX before 18.0.9.23 and 20 before 20.0.0.1494 allows SQL Injection via a first name, search string, or email address
CVE-2022-48483
3C
3cx
3cx
7.5
2%
May 23CX before 18 Hotfix 1 build 18.0.3.461 on Windows allows unauthenticated remote attackers to read %WINDIR%\system32 files via /Electron/download directory traversal in…
CVE-2022-48482
3C
3cx
3cx
7.5
2%
May 23CX before 18 Update 2 Security Hotfix build 18.0.2.315 on Windows allows unauthenticated remote attackers to read certain files via /Electron/download directory traversal
CVE-2023-29059
3C
3cx
3cx
7.8
4%
Mar 303CX DesktopApp through 18.12.416 has embedded malicious code, as exploited in the wild in March 2023
CVE-2019-9972
PS
Phone System Firmware
3cx
8.8
2%
Jun 7PhoneSystem Terminal in 3CX Phone System (Debian based installation) 16.0.0.1570 allows an authenticated attacker to run arbitrary commands with the phonesystem user privileges…
CVE-2019-9971
PS
Phone System Firmware
3cx
8.8
2%
Jun 7PhoneSystem Terminal in 3CX Phone System (Debian based installation) 16.0.0.1570 allows an attacker to gain root privileges by using sudo with the tcpdump command, without a…
CVE-2022-27438
CF
Call Flow Designer
3cx
8.1
2%
Jun 6Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer (Advanced Updater) are affected by a remote code execution…
CVE-2022-28005
3C
3cx
3cx
9.8
8%
May 6An issue was discovered in the 3CX Phone System Management Console prior to version 18 Update 3 FINAL
CVE-2021-45491
3C
3cx
3cx
6.5
1%
Mar 283CX System through 2022-03-17 stores cleartext passwords in a database
CVE-2021-45490
3C
3cx
3cx
9.1
1%
Mar 28The client applications in 3CX on Windows, the 3CX app for iOS, and the 3CX application for Android through 2022-03-17 lack SSL certificate validation
CVE-2019-12498
LC
Live Chat
3cx
9.8
2%
Mar 20The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplc_api_permission_check protection mechanism
CVE-2014-10386
LC
Live Chat
3cx
6.1
1%
Aug 22The wp-live-chat-support plugin before 4.1.0 for WordPress has JavaScript injections
CVE-2017-18507
LC
Live Chat
3cx
6.1
1%
Aug 13The wp-live-chat-support plugin before 7.1.05 for WordPress has XSS
CVE-2019-14950
LC
Live Chat
3cx
6.1
1%
Aug 12The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page
CVE-2017-18508
LC
Live Chat
3cx
6.1
1%
Aug 12The wp-live-chat-support plugin before 7.1.03 for WordPress has XSS
CVE-2016-10879
LC
Live Chat
3cx
6.1
1%
Aug 12The wp-live-chat-support plugin before 6.2.02 for WordPress has XSS
CVE-2019-14935
3C
3cx
3cx
7.8
0%
Aug 123CX Phone 15 on Windows has insecure permissions on the "%PROGRAMDATA%\3CXPhone for Windows\PhoneApp" installation directory, allowing Full Control access for Everyone, and…
CVE-2019-13176
3C
3cx
3cx
7.5
2%
Aug 8An issue was discovered in the 3CX Phone system (web) management console 12.5.44178.1002 through 12.5 SP2
CVE-2019-11185
LC
Live Chat
3cx
9.8
4%
Jun 3The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability
CVE-2019-9913
LC
Live Chat
3cx
6.1
1%
Mar 21The wp-live-chat-support plugin before 8.0.18 for WordPress has wp-admin/admin.php?page=wplivechat-menu-gdpr-page term XSS
CVE-2018-18460
LC
Live Chat
3cx
6.1
1%
Oct 18XSS exists in the wp-live-chat-support v8.0.15 plugin for WordPress via the modules/gdpr.php term parameter in a wp-admin/admin.php wplivechat-menu-gdpr-page request
CVE-2018-14905
3W
3cx Web Server
3cx
6.1
1%
Aug 3The Web server in 3CX version 15.5.8801.3 is vulnerable to Reflected XSS on the api/CallLog TimeZoneName parameter
CVE-2018-14907
3W
3cx Web Server
3cx
5.3
1%
Aug 3The Web server in 3CX version 15.5.8801.3 is vulnerable to Information Leakage, because of improper error handling in Stack traces, as demonstrated by discovering a full pathname
CVE-2018-14906
3W
3cx Web Server
3cx
6.1
1%
Aug 3The Web server in 3CX version 15.5.8801.3 is vulnerable to Reflected XSS on all stack traces' propertyPath parameters
CVE-2018-12426
LC
Live Chat
3cx
9.8
5%
Jul 2The WP Live Chat Support Pro plugin before 8.0.07 for WordPress is vulnerable to unauthenticated Remote Code Execution due to client-side validation of allowed file types, as…
CVE-2018-11105
LC
Live Chat
3cx
6.1
1%
May 15There is stored cross site scripting in the wp-live-chat-support plugin before 8.0.08 for WordPress via the "name" (aka wplc_name) and "email" (aka wplc_email) input fields to…
CVE-2018-9864
LC
Live Chat
3cx
6.1
1%
Apr 9The WP Live Chat Support plugin before 8.0.06 for WordPress has stored XSS via the Name field
CVE-2018-7654
3C
3cx
3cx
6.5
2%
Mar 4On 3CX 15.5.6354.2 devices, the parameter "file" in the request "/api/RecordingList/download?file=" allows full access to files on the server via path traversal
CVE-2017-15359
3C
3cx
3cx
6.5
6%
Oct 18In the 3CX Phone System 15.5.3554.1, the Management Console typically listens to port 5001 and is prone to a directory traversal attack: "/api/RecordingList/DownloadRecord?file="…
CVE-2017-2187
LC
Live Chat
3cx
6.1
1%
Jun 9Cross-site scripting vulnerability in WP Live Chat Support prior to version 7.0.07 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors
CVE-2008-6896
PS
Phone System
3cx
–
1%
Aug 3login.php in 3CX Phone System 6.0.806.0, when 100% disk capacity is reached, allows remote attackers to gain sensitive information via unspecified vectors that reveal the…
CVE-2008-6895
PS
Phone System
3cx
–
1%
Aug 33CX Phone System 6.0.806.0 allows remote attackers to cause a denial of service (unstable service or crash) via unspecified vectors, as demonstrated by vulnerability scans from…
CVE-2008-6894
PS
Phone System
3cx
–
1%
Aug 3Multiple cross-site scripting (XSS) vulnerabilities in login.php in 3CX Phone System Free Edition 6.1793 and 6.0.806.0 allow remote attackers to inject arbitrary web script or…