CVE-2019-19615

CVE-2019-19615 describes multiple Cross-Site Scripting (XSS) vulnerabilities in the Backup & Restore module (versions 14.0.10.2 through 14.0.10.7) of FreePBX. An attacker can inject malicious XSS code into the 'id' parameter of the backup configuration screen via a crafted link. This vulnerability has a CVSS score of 4.8 (Medium), indicating a low-impact attack requiring high privileges and user interaction, potentially leading to limited confidentiality and integrity compromise. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or inclusion in CISA's KEV catalog, though it has received some community and media attention.