CVE-2021-37524: Fusionpbx

Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days.

Cross Site Scripting (XSS) vulnerability in FusionPBX 4.5.26 allows remote unauthenticated users to inject arbitrary web script or HTML via an unsanitized "path" parameter in resources/login.php.

Affected products

• Fusionpbx Fusionpbx: before 5.0.1 (fixed in 5.0.1)

Published 2022-07-01. Last modified 2026-06-17.