Vulnerabilities

TI-2026-52907 CVE-2026-75600

FreePBX: Authenticated API generatedocs Host Command Injection

MEDIUM 41

FreePBX is an open source IP PBX.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00811 Published 2026-09-28 Fixed in 17.0.9 CWE-78

TI-2026-39525 CVE-2026-54710

FreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion)

MEDIUM 40

FreePBX is an open source IP PBX.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00512 Published 2026-09-28 Fixed in 16.0.40, 17.0.7 CWE-20

TI-2026-39524 CVE-2026-54708

Authenticated Remote Code Execution via Path Traversal in FreePBX Backup Module

MEDIUM 40

FreePBX is an open source IP PBX.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00526 Published 2026-09-28 Fixed in 16.0.72, 17.0.7 CWE-22

TI-2026-39498 CVE-2026-54675

FreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang Module

MEDIUM 41

FreePBX is an open source IP PBX.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00657 Published 2026-09-28 Fixed in 16.0.10, 17.0.5 CWE-22

TI-2026-39497 CVE-2026-54674

Authenticated Command Injection in FreePBX UCP Interface

MEDIUM 41

FreePBX is an open source IP PBX.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00879 Published 2026-09-28 Fixed in 16.0.39, 17.0.7 CWE-78

TI-2026-33311 CVE-2026-45562

FreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module

LOW 36

FreePBX is an open source IP PBX.

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.0036 Published 2026-09-28 Fixed in 16.0.4, 17.0.6 CWE-78

TI-2026-51749 CVE-2026-73665

FreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injection

MEDIUM 48

FreePBX is an open source IP PBX.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00331 Published 2026-08-13 Fixed in 17.0.9 CWE-862

TI-2026-51747 CVE-2026-73663

FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover

MEDIUM 48

FreePBX is an open source IP PBX.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.0038 Published 2026-08-13 Fixed in 16.0.11, 17.0.4 CWE-89

TI-2026-51746 CVE-2026-73662

Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files

LOW 37

FreePBX is an open source IP PBX.

CVSS 4.0HIGH 7.6 Network Low privileges No interaction EPSS 0.00879 Published 2026-08-13 Fixed in 17.0.7 CWE-78

TI-2026-51745 CVE-2026-73661

FreePBX: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted Backup

LOW 37

FreePBX is an open source IP PBX.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00308 Published 2026-08-13 Fixed in 16.0.47, 17.0.30 CWE-15

TI-2026-08424 CVE-2026-9588 · GHSA-xrh4-q49w-whmw

Authenticated Stored Cross-Site Scripting (XSS) in Switchvox SMB Web Portal

LOW 31

A stored cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997) within the voicemail notification template functionality.

CVSS 4.0HIGH 7.0 Network Low privileges User interaction EPSS 0.00405 Published 2026-07-17 Fixed in 8.4.0.2 CWE-79

TI-2026-08423 CVE-2026-9587 · GHSA-25gv-rxp9-h9pc

Authenticated Local File Inclusion (LFI) in Switchvox SMB Web Portal

LOW 31

An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997).

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00378 Published 2026-07-17 Fixed in 8.4.0.2 CWE-73

TI-2026-08422 CVE-2026-9586 · GHSA-m32j-v93f-gfgc

Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB

CRITICAL 99KEV

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997).

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.18979 Published 2026-07-17 Fixed in 8.4.0.2 CWE-89

TI-2026-08421 CVE-2026-9585 · GHSA-34c9-mcf5-3rp3

Unauthenticated Reflected Cross-Site Scripting (XSS) in Switchvox SMB Web Portal

MEDIUM 40

An unauthenticated reflected cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition version 8.3 (104997).

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00554 Published 2026-07-17 Fixed in 8.4.0.2 CWE-79

TI-2026-32214 CVE-2026-44237

FreePBX: Authenticated Access can lead to Subsequent OAuth2 Authentication Bypass in API Module

MEDIUM 40

FreePBX is an open source IP PBX.

CVSS 4.0HIGH 7.6 Network Low privileges No interaction EPSS 0.02702 Published 2026-05-29 Fixed in 17.0.8 CWE-1390

TI-2026-32215 CVE-2026-44238

FreePBX: Authenticated SQL Injection via ORDER BY in CDR Reports

LOW 39

FreePBX is an open source IP PBX.

CVSS 4.0HIGH 8.5 Network High privileges No interaction EPSS 0.00289 Published 2026-05-29 Fixed in 16.0.50, 17.0.11 CWE-89

TI-2026-32216 CVE-2026-44239

FreePBX: Authenticated Local File Inclusion in Dashboard Module

LOW 35

FreePBX is an open source IP PBX.

CVSS 4.0HIGH 7.6 Network Low privileges No interaction EPSS 0.00272 Published 2026-05-29 Fixed in 16.0.22, 17.0.5 CWE-98

TI-2026-34092 CVE-2026-46376

FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface

MEDIUM 48

FreePBX is an open source IP PBX.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00425 Published 2026-05-29 Fixed in 16.0.45, 17.0.7 CWE-798

TI-2026-33153 CVE-2026-45362 · GHSA-cxjw-p2qh-7hv8

Sangoma Switchvox before 8.4 places cleartext SIP authentication credentials in a backup file.

LOW 14

Sangoma Switchvox before 8.4 places cleartext SIP authentication credentials in a backup file.

CVSS 3.1LOW 3.2 Local No auth No interaction EPSS 0.00095 Published 2026-05-12 Fixed in 8.4 CWE-312

TI-2026-22594 CVE-2026-28287

FreePBX: Authenticated Remote Code Execution via Recordings Module AJAX Endpoints

MEDIUM 51

FreePBX is an open source IP PBX.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.09284 Published 2026-03-05 Fixed in 16.0.20, 17.0.5 CWE-78

TI-2026-22592 CVE-2026-28284

FreePBX: Authenticated SQL Injection Vulnerabilities in FreePBX Logfiles Module

LOW 39

FreePBX is an open source IP PBX.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00288 Published 2026-03-05 Fixed in 16.0.10, 17.0.5 CWE-89

TI-2026-22545 CVE-2026-28210

FreePBX: Authenticated SQL Injection in CDR (Call Data Record) Reports

LOW 39

FreePBX is an open source IP PBX.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00347 Published 2026-03-05 Fixed in 16.0.49, 17.0.7 CWE-89

TI-2026-22544 CVE-2026-28209

FreePBX: Command Injection leading to Remote Code Execution in FreePBX ElevenLabs Text-to-Speech integration

LOW 37

FreePBX is an open source IP PBX.

CVSS 4.0HIGH 7.5 Network High privileges No interaction EPSS 0.01029 Published 2026-03-05 Fixed in 16.0.20, 17.0.5 CWE-78

TI-2025-34885 CVE-2025-55210

FreePBX API has a Privilege Escalation Error in GraphQL Allowing Authenticated Users to Access Additional Scopes

LOW 13

FreePBX is an open-source web-based graphical user interface (GUI) that manages Asterisk.

CVSS 4.0LOW 2.0 Network Low privileges User interaction EPSS 0.00352 Published 2026-02-12 Fixed in 16.0.17, 17.0.5 CWE-270

TI-2026-19114 CVE-2026-23741

Uncontrolled search path in asterisk

LOW 37

Asterisk is an open source private branch exchange and telephony toolkit.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00211 Published 2026-02-06 Fixed in 23.2.2, 22.8.2 +3 CWE-427

Vulnerabilities

Filters