Medium
Security advisory
An issue was discovered in Contactmanager 13.x before 13.0.45.3, 14.x before 14.0.5.12, and 15.x before 15.0.8.21 for FreePBX 14.0.10.3. In the Contactmanager class (html\admin\modules\contactmanager\Contactmanager.class.php), an unsanitized group variable coming from the URL is reflected in HTML on 2 occasions, leading to XSS. It can be requested via a GET request to /admin/ajax.php?module=contactmanager.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-16966
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 08:52 UTC · Revision 1
Source evidence
An issue was discovered in Contactmanager 13.x before 13.0.45.3, 14.x before 14.0.5.12, and 15.x before 15.0.8.21 for FreePBX 14.0.10.3. In the Contactmanager class (html\admin\modules\contactmanager\Contactmanager.class.php), an unsanitized group variable coming from the URL is reflected in HTML on 2 occasions, leading to XSS. It can be requested via a GET request to /admin/ajax.php?module=contactmanager.
osv:CVE-2019-16966
Complete source record
{
"id": "f8f3c37f7176acb07e2d623a123cb1f5b86cc92ce0f8a9935a0b270e7e52e590",
"url": "https://osv.dev/vulnerability/CVE-2019-16966",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-16966",
"summary": "An issue was discovered in Contactmanager 13.x before 13.0.45.3, 14.x before 14.0.5.12, and 15.x before 15.0.8.21 for FreePBX 14.0.10.3. In the Contactmanager class (html\\admin\\modules\\contactmanager\\Contactmanager.class.php), an unsanitized group variable coming from the URL is reflected in HTML on 2 occasions, leading to XSS. It can be requested via a GET request to /admin/ajax.php?module=contactmanager.",
"evidence": "osv:CVE-2019-16966",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2019-16966",
"aliases": [
"CVE-2019-16966"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/freepbx/contactmanager",
"type": "GIT",
"events": [
{
"introduced": "8ca1e8389905bae2937e476fd3150aba5e0734f3"
},
{
"fixed": "407c80a93c8bcd05762fc66ff93f2c8f3b7f40a7"
},
{
"introduced": "b11cb56547db9b8f8b814230a46e0efea3ae718f"
},
{
"fixed": "4bf4cdb67fd31a7cab641c73b002a6ca06085c08"
},
{
"introduced": "8d26ffdc1b43b60a895d741db56336cce63d67b7"
},
{
"fixed": "64f46c6f6ca5f3e8b2f673343d1851cc178453d6"
},
{
"introduced": "30355d0c3753848e715e4a949a8b35b61d194943"
},
{
"last_affected": "3636f7893013e61831c829b3bdbd75e362cb15b0"
},
{
"fixed": "99e5aa0050224289cfe64c9036f38ce2531bf633"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:freepbx:contactmanager:*:*:*:*:*:freepbx:*:*",
"range": [
{
"introduced": "13.0.2"
},
{
"fixed": "13.0.45.3"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:freepbx:contactmanager:*:*:*:*:*:freepbx:*:*",
"range": [
{
"introduced": "14.0.1.1"
},
{
"fixed": "14.0.5.12"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:freepbx:contactmanager:*:*:*:*:*:freepbx:*:*",
"range": [
{
"introduced": "15.0.2"
},
{
"fixed": "15.0.8.21"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:freepbx:contactmanager:13.0.0:beta1:*:*:*:freepbx:*:*",
"range": [
{
"introduced": "13.0.0-beta1"
},
{
"last_affected": "13.0.0-beta1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:freepbx:contactmanager:13.0.0:beta2:*:*:*:freepbx:*:*",
"range": [
{
"introduced": "13.0.0-beta2"
},
{
"last_affected": "13.0.0-beta2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:freepbx:contactmanager:13.0.0:beta3:*:*:*:freepbx:*:*",
"range": [
{
"introduced": "13.0.0-beta3"
},
{
"last_affected": "13.0.0-beta3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:freepbx:contactmanager:13.0.0:beta4:*:*:*:freepbx:*:*",
"range": [
{
"introduced": "13.0.0-beta4"
},
{
"last_affected": "13.0.0-beta4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:freepbx:contactmanager:13.0.0:beta5:*:*:*:freepbx:*:*",
"range": [
{
"introduced": "13.0.0-beta5"
},
{
"last_affected": "13.0.0-beta5"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:freepbx:contactmanager:14.0.1:-:*:*:*:freepbx:*:*",
"range": [
{
"introduced": "14.0.1-NA"
},
{
"last_affected": "14.0.1-NA"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:freepbx:contactmanager:14.0.1:alpha1:*:*:*:freepbx:*:*",
"range": [
{
"introduced": "14.0.1-alpha1"
},
{
"last_affected": "14.0.1-alpha1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:freepbx:contactmanager:14.0.1:alpha2:*:*:*:freepbx:*:*",
"range": [
{
"introduced": "14.0.1-alpha2"
},
{
"last_affected": "14.0.1-alpha2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:freepbx:contactmanager:14.0.1:beta1:*:*:*:freepbx:*:*",
"range": [
{
"introduced": "14.0.1-beta1"
},
{
"last_affected": "14.0.1-beta1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:freepbx:contactmanager:14.0.1:beta2:*:*:*:freepbx:*:*",
"range": [
{
"introduced": "14.0.1-beta2"
},
{
"last_affected": "14.0.1-beta2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:freepbx:contactmanager:14.0.1:beta3:*:*:*:freepbx:*:*",
"range": [
{
"introduced": "14.0.1-beta3"
},
{
"last_affected": "14.0.1-beta3"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "99e5aa0050224289cfe64c9036f38ce2531bf633"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"13.0.0-beta1",
"13.0.0-beta2",
"13.0.0-beta3",
"13.0.0-beta4",
"13.0.0-beta5",
"14.0.1-NA",
"14.0.1-alpha1",
"14.0.1-alpha2",
"14.0.1-beta1",
"14.0.1-beta2",
"14.0.1-beta3",
"release/15.0.8.20",
"release/14.0.5.11",
"release/15.0.8.19",
"release/15.0.8.18",
"release/15.0.8.17",
"release/15.0.8.16",
"release/14.0.5.10",
"release/15.0.8.15",
"release/14.0.5.9",
"release/15.0.8.14",
"release/14.0.5.8",
"release/15.0.8.13",
"release/14.0.5.7",
"release/15.0.8.12",
"release/14.0.5.6",
"release/15.0.8.11",
"release/14.0.5.5",
"release/15.0.8.10",
"release/14.0.5.4",
"release/15.0.8.9",
"release/15.0.8.8",
"release/14.0.5.3",
"release/15.0.8.7",
"release/15.0.8.6",
"release/14.0.5.2",
"release/15.0.8.5",
"release/15.0.8.4",
"release/15.0.8.3",
"release/15.0.8.2",
"release/13.0.45",
"release/15.0.8.1",
"release/14.0.5.1",
"release/13.0.44",
"release/15.0.8",
"release/14.0.5",
"release/15.0.7",
"release/14.0.4.13",
"release/13.0.43.13",
"release/13.0.43.12",
"release/14.0.4.12",
"release/13.0.43.11",
"release/15.0.6",
"release/14.0.4.11",
"release/13.0.43.10",
"release/15.0.5",
"release/14.0.4.10",
"release/14.0.4.9",
"release/13.0.43.9",
"release/13.0.43.8",
"release/15.0.4",
"release/15.0.3",
"release/15.0.2",
"release/13.0.43.7",
"release/13.0.43.6",
"release/13.0.43.5",
"release/13.0.43.4",
"release/13.0.43.3",
"release/13.0.43.2",
"release/13.0.43.1",
"release/13.0.43",
"release/13.0.42.13",
"release/13.0.42.12",
"release/13.0.42.11",
"release/13.0.42.10",
"release/13.0.42.9",
"release/13.0.42.8",
"release/13.0.42.7",
"release/13.0.42.5",
"release/13.0.42.4",
"release/13.0.42.3",
"release/14.0.1beta3",
"release/13.0.42.2",
"release/13.0.42.1",
"release/13.0.42",
"release/13.0.41.14",
"release/13.0.41.13",
"release/13.0.41.12",
"release/14.0.1beta2",
"release/13.0.41.11",
"release/14.0.1beta1",
"release/14.0.1alpha2",
"release/13.0.41.10",
"release/14.0.1alpha1",
"release/13.0.41.8",
"release/13.0.41.7",
"release/13.0.41.6",
"release/13.0.41.5",
"release/13.0.41.4",
"release/13.0.41.3",
"release/13.0.41",
"release/13.0.40",
"release/13.0.38",
"release/13.0.37",
"release/13.0.36",
"release/13.0.35",
"release/13.0.34",
"release/13.0.33",
"release/13.0.32",
"release/13.0.31",
"release/13.0.30",
"release/13.0.29",
"release/13.0.28",
"release/13.0.27",
"release/13.0.26",
"release/13.0.25",
"release/13.0.24",
"release/13.0.23",
"release/13.0.22",
"release/13.0.21",
"release/13.0.20",
"release/13.0.17",
"release/13.0.16",
"release/13.0.15",
"release/13.0.14",
"release/13.0.13",
"release/13.0.12",
"release/13.0.11",
"release/13.0.10",
"release/13.0.9",
"release/13.0.8",
"release/13.0.6",
"release/13.0.5",
"release/13.0.4",
"release/13.0.3",
"release/13.0.2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-16966.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/freepbx/framework",
"type": "GIT",
"events": [
{
"introduced": "fef337a31ecbe7ab2559348030f608dbde66d856"
},
{
"last_affected": "fef337a31ecbe7ab2559348030f608dbde66d856"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:sangoma:freepbx:14.0.10.3:*:*:*:*:*:*:*",
"range": [
{
"introduced": "14.0.10.3"
},
{
"last_affected": "14.0.10.3"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"14.0.10.3",
"release/14.0.10.3"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-16966.json"
}
}
],
"modified": "2026-10-24T10:50:35.611568723Z",
"provider": "osv",
"references": [
"https://issues.freepbx.org/browse/FREEPBX-20437",
"https://github.com/FreePBX/contactmanager/commit/99e5aa0050224289cfe64c9036f38ce2531bf633",
"https://resp3ctblog.wordpress.com/2019/10/19/freepbx-xss-1/"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:sangoma:freepbx:14.0.10.3:*:*:*:*:*:*:*"
],
"vendor_product": "sangoma:freepbx",
"extracted_events": [
{
"range": [
{
"introduced": "14.0.10.3"
},
{
"last_affected": "14.0.10.3"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2019-16966",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 442328,
"published_at": "2019-10-21T19:15:11.03+00:00"
}