Skip to content
Noroxi

3CX records

34 published records for vendor 3cx.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
3
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 22
  6. 23
  7. 24

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

Bug bounty scope

The product’s vendor appears in a public program. Matched by name; verify the scope text in the program.

All records

34 records
  • CVE-2022-28005
    42Plan

    An issue was discovered in the 3CX Phone System Management Console prior to version 18 Update 3 FINAL.

    CriticalCVSS 9.8No exploitEPSS 8%

    3cx · 3cxMay 6, 2022

  • CVE-2018-12426
    41Plan

    The WP Live Chat Support Pro plugin before 8.0.07 for WordPress is vulnerable to unauthenticated Remote Code Execution due to client-side va

    CriticalCVSS 9.8No exploitEPSS 5%

    3cx · live chatJul 2, 2018

  • CVE-2019-11185
    40Plan

    The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability.

    CriticalCVSS 9.8No exploitEPSS 4%

    3cx · live chatJun 3, 2019

  • CVE-2023-49954
    40Plan

    The CRM Integration in 3CX before 18.0.9.23 and 20 before 20.0.0.1494 allows SQL Injection via a first name, search string, or email address

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    3cx · 3cxDec 25, 2023

  • CVE-2019-12498
    40Plan

    The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplc_api_permission_check pr

    CriticalCVSS 9.8No exploitEPSS 1%

    3cx · live chatMar 20, 2020

  • CVE-2019-9972
    36Monitor

    PhoneSystem Terminal in 3CX Phone System (Debian based installation) 16.0.0.1570 allows an authenticated attacker to run arbitrary commands

    HighCVSS 8.8No exploitEPSS 1%

    3cx · phone system firmwareJun 7, 2022

  • CVE-2019-9971
    36Monitor

    PhoneSystem Terminal in 3CX Phone System (Debian based installation) 16.0.0.1570 allows an attacker to gain root privileges by using sudo wi

    HighCVSS 8.8No exploitEPSS 1%

    3cx · phone system firmwareJun 7, 2022

  • CVE-2021-45490
    36Monitor

    The client applications in 3CX on Windows, the 3CX app for iOS, and the 3CX application for Android through 2022-03-17 lack SSL certificate

    CriticalCVSS 9.1No exploitEPSS 1%

    3cx · 3cxMar 27, 2022

  • CVE-2022-27438
    33Monitor

    Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer (Advanced Updater) are affect

    HighCVSS 8.1Proof of conceptEPSS 1%

    caphyon · advanced installerJun 6, 2022

  • CVE-2023-29059
    32Monitor

    3CX DesktopApp through 18.12.416 has embedded malicious code, as exploited in the wild in March 2023.

    HighCVSS 7.8No exploitEPSS 4%

    3cx · 3cxMar 30, 2023

  • CVE-2019-13176
    31Monitor

    An issue was discovered in the 3CX Phone system (web) management console 12.5.44178.1002 through 12.5 SP2.

    HighCVSS 7.5No exploitEPSS 2%

    3cx · 3cxAug 8, 2019

  • CVE-2022-48482
    31Monitor

    3CX before 18 Update 2 Security Hotfix build 18.0.2.315 on Windows allows unauthenticated remote attackers to read certain files via /Electr

    HighCVSS 7.5No exploitEPSS 1%

    3cx · 3cxMay 2, 2023

  • CVE-2022-48483
    31Monitor

    3CX before 18 Hotfix 1 build 18.0.3.461 on Windows allows unauthenticated remote attackers to read %WINDIR%\system32 files via /Electron/dow

    HighCVSS 7.5No exploitEPSS 1%

    3cx · 3cxMay 2, 2023

  • CVE-2008-6895
    31Monitor

    3CX Phone System 6.0.806.0 allows remote attackers to cause a denial of service (unstable service or crash) via unspecified vectors, as demo

    HighCVSS 7.8No exploitEPSS 1%

    3cx · phone systemAug 3, 2009

  • CVE-2023-27362
    31Monitor

    3CX Uncontrolled Search Path Local Privilege Escalation Vulnerability

    HighCVSS 7.8No exploitEPSS 0%

    3cx · 3cxMay 2, 2024

  • CVE-2019-14935
    31Monitor

    3CX Phone 15 on Windows has insecure permissions on the "%PROGRAMDATA%\3CXPhone for Windows\PhoneApp" installation directory, allowing Full

    HighCVSS 7.8No exploitEPSS 0%

    3cx · 3cxAug 11, 2019

  • CVE-2017-15359
    28Monitor

    In the 3CX Phone System 15.5.3554.1, the Management Console typically listens to port 5001 and is prone to a directory traversal attack: "/a

    MediumCVSS 6.5Proof of conceptEPSS 6%

    3cx · 3cxOct 18, 2017

  • CVE-2018-7654
    27Monitor

    On 3CX 15.5.6354.2 devices, the parameter "file" in the request "/api/RecordingList/download?file=" allows full access to files on the serve

    MediumCVSS 6.5No exploitEPSS 2%

    3cx · 3cxMar 3, 2018

  • CVE-2021-45491
    26Monitor

    3CX System through 2022-03-17 stores cleartext passwords in a database.

    MediumCVSS 6.5No exploitEPSS 0%

    3cx · 3cxMar 27, 2022

  • CVE-2019-9913
    24Monitor

    The wp-live-chat-support plugin before 8.0.18 for WordPress has wp-admin/admin.php?page=wplivechat-menu-gdpr-page term XSS.

    MediumCVSS 6.1No exploitEPSS 1%

    3cx · live chatMar 21, 2019

  • CVE-2018-9864
    24Monitor

    The WP Live Chat Support plugin before 8.0.06 for WordPress has stored XSS via the Name field.

    MediumCVSS 6.1No exploitEPSS 1%

    3cx · live chatApr 9, 2018

  • CVE-2017-2187
    24Monitor

    Cross-site scripting vulnerability in WP Live Chat Support prior to version 7.0.07 allows remote attackers to inject arbitrary web script or

    MediumCVSS 6.1No exploitEPSS 1%

    3cx · live chatJun 9, 2017

  • CVE-2019-14950
    24Monitor

    The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page.

    MediumCVSS 6.1Proof of conceptEPSS 1%

    3cx · live chatAug 12, 2019

  • CVE-2018-11105
    24Monitor

    There is stored cross site scripting in the wp-live-chat-support plugin before 8.0.08 for WordPress via the "name" (aka wplc_name) and "emai

    MediumCVSS 6.1No exploitEPSS 1%

    3cx · live chatMay 15, 2018

  • CVE-2018-18460
    24Monitor

    XSS exists in the wp-live-chat-support v8.0.15 plugin for WordPress via the modules/gdpr.php term parameter in a wp-admin/admin.php wplivech

    MediumCVSS 6.1No exploitEPSS 1%

    3cx · live chatOct 18, 2018