CVE Intelligence

Vulnerabilidades do Sangoma Switchvox SMB Edition

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Sangoma Switchvox SMB Edition: 4 registro(s), com versões afetadas e correções.

CVE-2026-9588 Alta · 7.0 CWE-79 17/07/2026
Authenticated Stored Cross-Site Scripting (XSS) in Switchvox SMB Web Portal
A stored cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997) within the voicemail notification template functionality. The submit_modify_voicemail_template endpoint fails to properly sanitize HTML content supplied by authenticated users, allowing malicious JavaScript supplied through the template_text parameter to be stored server-side and subsequently rendered to other users.
CVE-2026-9587 Alta · 7.1 CWE-73 17/07/2026
Authenticated Local File Inclusion (LFI) in Switchvox SMB Web Portal
An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The play_file functionality accepts user-controlled input through the sound_path parameter and fails to properly validate file paths before accessing the underlying filesystem. By supplying absolute paths, an authenticated attacker can retrieve files outside the intended directory scope.
CVE-2026-9586 Crítica · 9.8 KEV Urgente · 73 Exploit público CWE-89 17/07/2026
Sangoma Switchvox SQL Injection Vulnerability
An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.
CVE-2026-9585 Alta · 8.6 CWE-79 17/07/2026
Unauthenticated Reflected Cross-Site Scripting (XSS) in Switchvox SMB Web Portal
An unauthenticated reflected cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition version 8.3 (104997). The application fails to properly sanitize the portal parameter supplied to the invalid_browser and invalid_browser_login handlers. User-supplied data is reflected into JavaScript generated by the application, allowing attacker-controlled script execution within a victim's browser.