PT-2025-13808 · Xorcom · Xorcom Completepbx

Valentin Lobstein · Published 2025-03-31 · Updated 2025-09-24 · CVE-2025-30006

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Xorcom CompletePBX versions prior to 5.2.35

Description The issue is a reflected cross-site scripting (XSS) in the administrative control panel. This type of issue occurs when an application takes user input and reflects it back to the user without proper validation or encoding, allowing an attacker to inject malicious scripts.

Recommendations For versions prior to 5.2.35, update to version 5.2.35 or later to resolve the issue. As a temporary workaround, consider restricting access to the administrative control panel to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-30006

Affected Products

Xorcom Completepbx

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-30006 · Security Note
• https://osv.dev/vulnerability/CVE-2025-30006 · Vendor Advisory
• https://xorcom.com/new-completepbx-release-5-2-36-1 · Vendor Advisory
• https://twitter.com/CVEnew/status/1906757209926565978 · Twitter Post
• https://vulncheck.com/advisories/completepbx-reflected-xss · Note
• https://t.me/cvedetector/21636 · Telegram Post
• https://twitter.com/Chocapikk_/status/1906794610279739752 · Twitter Post
• https://t.me/cvetracker/20372 · Telegram Post
• https://t.me/cveNotify/136291 · Telegram Post