Vulnerabilities

TI-2026-52907 CVE-2026-75600

FreePBX: Authenticated API generatedocs Host Command Injection

MEDIUM 41

FreePBX is an open source IP PBX.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00811 Published 2026-09-28 Fixed in 17.0.9 CWE-78

TI-2026-39525 CVE-2026-54710

FreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion)

MEDIUM 40

FreePBX is an open source IP PBX.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00512 Published 2026-09-28 Fixed in 16.0.40, 17.0.7 CWE-20

TI-2026-39524 CVE-2026-54708

Authenticated Remote Code Execution via Path Traversal in FreePBX Backup Module

MEDIUM 40

FreePBX is an open source IP PBX.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00526 Published 2026-09-28 Fixed in 16.0.72, 17.0.7 CWE-22

TI-2026-39498 CVE-2026-54675

FreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang Module

MEDIUM 41

FreePBX is an open source IP PBX.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00657 Published 2026-09-28 Fixed in 16.0.10, 17.0.5 CWE-22

TI-2026-39497 CVE-2026-54674

Authenticated Command Injection in FreePBX UCP Interface

MEDIUM 41

FreePBX is an open source IP PBX.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00879 Published 2026-09-28 Fixed in 16.0.39, 17.0.7 CWE-78

TI-2026-33311 CVE-2026-45562

FreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module

LOW 36

FreePBX is an open source IP PBX.

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.0036 Published 2026-09-28 Fixed in 16.0.4, 17.0.6 CWE-78

TI-2026-51749 CVE-2026-73665

FreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injection

MEDIUM 48

FreePBX is an open source IP PBX.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00331 Published 2026-08-13 Fixed in 17.0.9 CWE-862

TI-2026-51747 CVE-2026-73663

FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover

MEDIUM 48

FreePBX is an open source IP PBX.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.0038 Published 2026-08-13 Fixed in 16.0.11, 17.0.4 CWE-89

TI-2026-51746 CVE-2026-73662

Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files

LOW 37

FreePBX is an open source IP PBX.

CVSS 4.0HIGH 7.6 Network Low privileges No interaction EPSS 0.00879 Published 2026-08-13 Fixed in 17.0.7 CWE-78

TI-2026-51745 CVE-2026-73661

FreePBX: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted Backup

LOW 37

FreePBX is an open source IP PBX.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00308 Published 2026-08-13 Fixed in 16.0.47, 17.0.30 CWE-15

TI-2026-32214 CVE-2026-44237

FreePBX: Authenticated Access can lead to Subsequent OAuth2 Authentication Bypass in API Module

MEDIUM 40

FreePBX is an open source IP PBX.

CVSS 4.0HIGH 7.6 Network Low privileges No interaction EPSS 0.02702 Published 2026-05-29 Fixed in 17.0.8 CWE-1390

TI-2026-32215 CVE-2026-44238

FreePBX: Authenticated SQL Injection via ORDER BY in CDR Reports

LOW 39

FreePBX is an open source IP PBX.

CVSS 4.0HIGH 8.5 Network High privileges No interaction EPSS 0.00289 Published 2026-05-29 Fixed in 16.0.50, 17.0.11 CWE-89

TI-2026-32216 CVE-2026-44239

FreePBX: Authenticated Local File Inclusion in Dashboard Module

LOW 35

FreePBX is an open source IP PBX.

CVSS 4.0HIGH 7.6 Network Low privileges No interaction EPSS 0.00272 Published 2026-05-29 Fixed in 16.0.22, 17.0.5 CWE-98

TI-2026-34092 CVE-2026-46376

FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface

MEDIUM 48

FreePBX is an open source IP PBX.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00425 Published 2026-05-29 Fixed in 16.0.45, 17.0.7 CWE-798

TI-2026-22594 CVE-2026-28287

FreePBX: Authenticated Remote Code Execution via Recordings Module AJAX Endpoints

MEDIUM 51

FreePBX is an open source IP PBX.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.09284 Published 2026-03-05 Fixed in 16.0.20, 17.0.5 CWE-78

TI-2026-22592 CVE-2026-28284

FreePBX: Authenticated SQL Injection Vulnerabilities in FreePBX Logfiles Module

LOW 39

FreePBX is an open source IP PBX.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00288 Published 2026-03-05 Fixed in 16.0.10, 17.0.5 CWE-89

TI-2026-22545 CVE-2026-28210

FreePBX: Authenticated SQL Injection in CDR (Call Data Record) Reports

LOW 39

FreePBX is an open source IP PBX.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00347 Published 2026-03-05 Fixed in 16.0.49, 17.0.7 CWE-89

TI-2026-22544 CVE-2026-28209

FreePBX: Command Injection leading to Remote Code Execution in FreePBX ElevenLabs Text-to-Speech integration

LOW 37

FreePBX is an open source IP PBX.

CVSS 4.0HIGH 7.5 Network High privileges No interaction EPSS 0.01029 Published 2026-03-05 Fixed in 16.0.20, 17.0.5 CWE-78

TI-2025-34885 CVE-2025-55210

FreePBX API has a Privilege Escalation Error in GraphQL Allowing Authenticated Users to Access Additional Scopes

LOW 13

FreePBX is an open-source web-based graphical user interface (GUI) that manages Asterisk.

CVSS 4.0LOW 2.0 Network Low privileges User interaction EPSS 0.00352 Published 2026-02-12 Fixed in 16.0.17, 17.0.5 CWE-270

TI-2025-41432 CVE-2025-67736

Authenticated SQL Injection in FreePBX tts (Text To Speech) module

MEDIUM 49

The FreePBX module tts (Text to Speech) for FreePBX, an open-source web-based graphical user interface (GUI) that manages Asterisk.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.06434 Published 2025-12-16 Fixed in 16.0.5, 17.0.5 CWE-89

TI-2025-41418 CVE-2025-67722

Untrusted search path in FreePBX framework

LOW 27

FreePBX is an open-source web-based graphical user interface (GUI) that manages Asterisk.

CVSS 4.0MEDIUM 5.7 Local High privileges No interaction EPSS 0.00128 Published 2025-12-16 Fixed in 16.0.45, 17.0.24 CWE-426

TI-2024-38391 CVE-2024-58294 · GHSA-3f55-6gfh-8xfx

FreePBX 16 Authenticated Remote Code Execution via API Module

HIGH 73

FreePBX 16 contains an authenticated remote code execution vulnerability in the API module that allows attackers with valid session credentials to execute arbitrary commands.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.03568 Published 2025-12-11 No fix listed CWE-78

TI-2025-40565 CVE-2025-66039

FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header

MEDIUM 54

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.03391 Published 2025-12-09 Fixed in 16.0.44, 17.0.23 CWE-287

TI-2025-36981 CVE-2025-59429

FreePBX core module vulnerable to reflected cross-site scripting via Asterisk HTTP Status page

HIGH 70

FreePBX is an open source GUI for managing Asterisk.

CVSS 4.0HIGH 8.5 Network Low privileges User interaction EPSS 0.00198 Published 2025-10-14 Fixed in 16.0.68.39, 17.0.18.38 CWE-79

TI-2025-36698 CVE-2025-59056

FreePBX vulnerable to unauthenticated Denial of Service

LOW 36

FreePBX is an open-source web-based graphical user interface.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00465 Published 2025-09-15 Fixed in 15.0.38, 16.0.41 +1 CWE-22

Vulnerabilities

Filters