https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-0986.htmlhttps://patchthecve.com/cve/CVE-2024-0986.htmlWed, 17 Jun 2026 06:54:42 +0000MEDIUM 4.7: A vulnerability was found in Issabel PBX 4.0.0. It has been rated as critical. This issue affects some unknown processing of the file /index.php?menu=asterisk_cli of the component Asterisk-Cli. The manipulation of the argument Command leads to os command injection. The attack may be initiated remotehttps://patchthecve.com/cve/CVE-2023-37599.htmlhttps://patchthecve.com/cve/CVE-2023-37599.htmlWed, 17 Jun 2026 06:08:31 +0000HIGH 7.5: An issue in issabel-pbx v.4.0.0-6 allows a remote attacker to obtain sensitive information via the modules directoryhttps://patchthecve.com/cve/CVE-2023-37598.htmlhttps://patchthecve.com/cve/CVE-2023-37598.htmlWed, 17 Jun 2026 06:08:30 +0000MEDIUM 4.5: A Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial of service via the delete new virtual fax function.https://patchthecve.com/cve/CVE-2023-37597.htmlhttps://patchthecve.com/cve/CVE-2023-37597.htmlWed, 17 Jun 2026 06:08:30 +0000HIGH 8.1: Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial of service via the delete user grouplist function.https://patchthecve.com/cve/CVE-2023-37596.htmlhttps://patchthecve.com/cve/CVE-2023-37596.htmlWed, 17 Jun 2026 06:08:30 +0000HIGH 8.1: Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial of service via a crafted script to the deleteuser function.https://patchthecve.com/cve/CVE-2023-37190.htmlhttps://patchthecve.com/cve/CVE-2023-37190.htmlWed, 17 Jun 2026 06:07:41 +0000MEDIUM 4.8: A stored cross-site scripting (XSS) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Virtual Fax Name and Caller ID Name parameters under the New Virtual Fax feature.https://patchthecve.com/cve/CVE-2023-37189.htmlhttps://patchthecve.com/cve/CVE-2023-37189.htmlWed, 17 Jun 2026 06:07:41 +0000MEDIUM 4.8: A stored cross site scripting (XSS) vulnerability in index.php?menu=billing_rates of Issabel PBX version 4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the Name or Prefix fields under the Create New Rate module.https://patchthecve.com/cve/CVE-2023-37191.htmlhttps://patchthecve.com/cve/CVE-2023-37191.htmlWed, 17 Jun 2026 06:07:41 +0000MEDIUM 4.8: A stored cross-site scripting (XSS) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Group and Description parameters.https://patchthecve.com/cve/CVE-2023-34839.htmlhttps://patchthecve.com/cve/CVE-2023-34839.htmlWed, 17 Jun 2026 06:04:03 +0000MEDIUM 6.8: A Cross Site Request Forgery (CSRF) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows a remote attacker to gain privileges via a Custom CSRF exploit to create new user function in the application.