Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2531▼ 362 respecto a la semana anterior
Críticas / altas1340▲ 76 respecto a la semana anterior
Nueva explotación activa (KEV)6▼ 5 respecto a la semana anterior
Sin puntuar (sin CVSS)62▼ 466 respecto a la semana anterior
6 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Aplazada | Alta (7) | 0.40% | — | Sangoma Switchvox SMB EditionAI | 17/7/2026 | 17/7/2026 | A stored cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997) within the voicemail notification template functionality. The submit_modify_voicemail_template endpoint fails to properly sanitize HTML content supplied by authenticated users, allowing malicious JavaScript supplied… | |
| Aplazada | Alta (7.1) | 0.38% | — | Sangoma Switchvox SMB EditionAI | 17/7/2026 | 17/7/2026 | An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The play_file functionality accepts user-controlled input through the sound_path parameter and fails to properly validate file paths before accessing the underlying filesystem. By supplying absolute paths, an… | |
| Analizada | Crítica (9.3) | 19% | ⚠ Explotación activa | Sangoma Switchvox | 17/7/2026 | 3/9/2026 | An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated… | |
| Aplazada | Alta (8.6) | 0.55% | — | Sangoma Switchvox SMB EditionAI | 17/7/2026 | 17/7/2026 | An unauthenticated reflected cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition version 8.3 (104997). The application fails to properly sanitize the portal parameter supplied to the invalid_browser and invalid_browser_login handlers. User-supplied data is reflected into JavaScript… | |
| Aplazada | Baja (3.2) | 0.11% | — | Sangoma SwitchvoxAI | 12/5/2026 | 17/6/2026 | Sangoma Switchvox before 8.4 places cleartext SIP authentication credentials in a backup file. | |
| Modificada | Media (5.3) | 0.90% | — | Sangoma Switchvox | 14/2/2022 | 17/6/2026 | Sangoma Technologies Corporation Switchvox Version 102409 is affected by an information disclosure vulnerability due to an improper access restriction. Users information such as first name, last name, acount id, server uuid, email address, profile image, number, timestamps, etc can be extracted by sending an… |