CVE-2020-11766: Avantfax

High severity, CVSS 8.8. EPSS: 1.8% chance of exploitation in the next 30 days.

sendfax.php in iFAX AvantFAX before 3.3.6 and HylaFAX Enterprise Web Interface before 0.2.5 allows authenticated Command Injection.

Affected products

• Avantfax Avantfax: from 3.3.0, before 3.3.6 (fixed in 3.3.6)
• Ifax Hylafax: from 0.2.0, before 0.2.5 (fixed in 0.2.5)

Published 2020-05-19. Last modified 2026-06-17.