Skip to content
OpenAdvisories

Vendor

VICIdial

6 known vulnerabilities.

Products

VICIdial 6
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 8.8
    CVE-2024-8504 Public exploit EPSS 76%

    VICIdial Authenticated Remote Code Execution

    An attacker with authenticated access to VICIdial as an "agent" can execute arbitrary shell commands as the "root" user. This attack can be chained with CVE-2024-8503 to execute arbitrary shell commands starting from an unauthenticated perspective.

    VICIdial VICIdial
  • Critical 9.8
    CVE-2024-8503 Public exploit Scanner template EPSS 79%

    VICIdial Unauthenticated SQL Injection

    An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. By default, VICIdial stores plaintext credentials within the database.

    VICIdial VICIdial
  • Medium 5.5
    CVE-2022-34878 Public exploit

    VICIDial 2.14b0.5 SVN 3550 was discovered to contain a SQL injection vulnerability at /vicidial/user_stats.php.

    SQL Injection vulnerability in User Stats interface (/vicidial/user_stats.php) of VICIdial via the file_download parameter allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, destroy the data …

    VICIdial VICIdial
  • Medium 6.4
    CVE-2022-34877 Public exploit

    VICIDial 2.14b0.5 SVN 3550 was discovered to contains a SQL injection vulnerability at /vicidial/AST_agent_time_sheet.php.

    SQL Injection vulnerability in AST Agent Time Sheet interface ((/vicidial/AST_agent_time_sheet.php) of VICIdial via the agent parameter allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, dest…

    VICIdial VICIdial
  • Medium 5.5
    CVE-2022-34876 Public exploit

    VICIDial 2.14b0.5 SVN 3550 was discovered to contain multiple SQL injection vulnerability at /vicidial/admin.php.

    SQL Injection vulnerability in admin interface (/vicidial/admin.php) of VICIdial via modify_email_accounts, access_recordings, and agentcall_email parameters allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all da…

    VICIdial VICIdial