Nchsoftware Axon Pbx — known CVE vulnerabilities

Every CVE whose affected-product data names Nchsoftware Axon Pbx, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (10)

• CVE-2021-37453 — CVSS 5.4 (medium): Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the extension name (stored).
• CVE-2021-37454 — CVSS 5.4 (medium): Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the line name (stored).
• CVE-2021-37455 — CVSS 5.4 (medium): Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the outbound dialing plan (stored).
• CVE-2021-37456 — CVSS 5.4 (medium): Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the blacklist IP address (stored).
• CVE-2021-37457 — CVSS 5.4 (medium): Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the SipRule field (stored).
• CVE-2021-37458 — CVSS 5.4 (medium): Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the primary phone field (stored).
• CVE-2021-37459 — CVSS 5.4 (medium): Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the customer name field (stored).
• CVE-2021-37460 — CVSS 5.4 (medium): Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /planprop?id= (reflected).
• CVE-2021-37461 — CVSS 5.4 (medium): Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /extensionsinstruction?id= (reflected).
• CVE-2021-37462 — CVSS 5.4 (medium): Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /ipblacklist?errorip= (reflected).