Filtered by vendor Sangoma Subscriptions
Filtered by product Switchvox Subscriptions

Search

Switch to Advanced Search (Beta)
Total 3 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-9586 1 Sangoma 2 Switchvox, Switchvox Smb Edition 2026-09-03 9.8 Critical
An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.
CVE-2026-45362 1 Sangoma 1 Switchvox 2026-05-12 3.2 Low
Sangoma Switchvox before 8.4 places cleartext SIP authentication credentials in a backup file.
CVE-2021-45310 1 Sangoma 1 Switchvox 2024-11-21 5.3 Medium
Sangoma Technologies Corporation Switchvox Version 102409 is affected by an information disclosure vulnerability due to an improper access restriction. Users information such as first name, last name, acount id, server uuid, email address, profile image, number, timestamps, etc can be extracted by sending an unauthenticated HTTP GET request to the https://Switchvox-IP/main?cmd=invalid_browser.