CVE-2019-16978

CVE-2019-16978 is a reflected Cross-Site Scripting (XSS) vulnerability affecting FusionPBX up to version 4.5.7. It arises from the app\devices\device_settings.php file failing to sanitize the "id" variable from the URL, which is then reflected in the HTML. This vulnerability has a CVSS score of 6.1 (MEDIUM), indicating it can be exploited over the network with low attack complexity, requiring user interaction, and potentially leading to low confidentiality and integrity impacts. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.