Avantfax: >> Avantfax >> 3.3.3 Security Vulnerabilities
In HylaFAX Enterprise Web Interface and AvantFAX, the language form element is not properly sanitized
before being used and can be misused to include an arbitrary file in the
PHP code allowing an attacker to do anything as the web server user.
This flaw requires the attacker to be authenticated with a valid user account.
CVSS Score
9.9
EPSS Score
0.005
Published
2025-04-14
sendfax.php in iFAX AvantFAX before 3.3.6 and HylaFAX Enterprise Web Interface before 0.2.5 allows authenticated Command Injection.
CVSS Score
8.8
EPSS Score
0.018
Published
2020-05-19
AvantFAX 3.3.3 has XSS via an arbitrary parameter name to the default URI, as demonstrated by a parameter whose name contains a SCRIPT element and whose value is 1.
CVSS Score
6.1
EPSS Score
0.045
Published
2018-01-10