---
id: CVE-2025-30006
title: Xorcom CompletePBX <= 5.2.35 Reflected Cross-Site Scripting
summary: >-
  Xorcom CompletePBX is vulnerable to a reflected cross-site scripting (XSS) in
  the administrative control panel.





  This issue affects CompletePBX: all versions up to and including 5.2.35
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: Xorcom
product: CompletePBX
affected:
  - CompletePBX <= 5.2.35
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2025-03-31T17:52:58.579395Z'
published: '2025-03-31'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T21:15:12.772Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-30006'
references:
  - url: 'https://vulncheck.com/advisories/completepbx-reflected-xss'
  - url: 'https://www.xorcom.com/new-completepbx-release-5-2-36-1/'
tags:
  - cve.org
epss: 0.00249
epssPercentile: 0.16344
ingestedAt: '2026-11-03T08:39:35.537Z'
---

## Overview

Xorcom CompletePBX is vulnerable to a reflected cross-site scripting (XSS) in the administrative control panel.




This issue affects CompletePBX: all versions up to and including 5.2.35

## Affected

- `CompletePBX <= 5.2.35`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.