https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-10T14:53:08.411340+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cnvd-2019-36990 cnvd-2019-36990 2026-11-10T14:53:08.415173+00:00 cnvd-2019-36990 https://db.gcve.eu/vuln/fkie_cve-2019-16990 fkie_cve-2019-16990 2026-11-10T14:53:08.415220+00:00

In FusionPBX up to v4.5.7, the file app/music_on_hold/music_on_hold.php uses an unsanitized "file" variable coming from the URL, which takes any pathname (base64 encoded) and allows a download of it.

 https://db.gcve.eu/vuln/ghsa-33r6-wr5p-6jqw GHSA-33r6-wr5p-6jqw 2026-11-10T14:53:08.415258+00:00

In FusionPBX up to v4.5.7, the file app/music_on_hold/music_on_hold.php uses an unsanitized "file" variable coming from the URL, which takes any pathname (base64 encoded) and allows a download of it.

 https://db.gcve.eu/vuln/gsd-2019-16990 gsd-2019-16990 2026-11-10T14:53:08.415278+00:00 gsd-2019-16990