Browser script execution via unencoded fax names

Stored XSS in Issabel PBX 4.0.0-6 allows remote authenticated users to execute scripts in another user's browser through fax names. The New Virtual Fax form stores the Virtual Fax Name and Caller ID Name without adequate sanitization or output encoding, then renders those values in the Virtual Fax listing. An account with Fax-module access must submit the payload, and execution occurs when another user views the listing, exposing that user's session and permitting actions in that user's application context.