CVE-2025-57819

🗓️ 28 Aug 2025 16:45:18Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 44 Media mentions👁 678 Views🌐 WEB

Unauthenticated access enables SQL injection and remote code execution in FreePBX.

Reporter	Title	Published	Views	Family All 46
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Sangoma Freepbx	8 Sep 202515:28	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Sangoma Freepbx	7 Jun 202600:54	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Sangoma Freepbx	8 Jun 202610:22	–	githubexploit
GithubExploit	Exploit for CVE-2025-57819	29 Aug 202511:59	–	githubexploit
GithubExploit	Exploit for SQL Injection in Sangoma Freepbx	4 Sep 202503:21	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Sangoma Freepbx	18 Sep 202520:38	–	githubexploit
GithubExploit	security-research	9 Jul 202615:08	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Sangoma Freepbx	12 Sep 202517:53	–	githubexploit
GithubExploit	Exploit for SQL Injection in Sangoma Freepbx	1 Jul 202620:09	–	githubexploit
GithubExploit	Exploit for SQL Injection in Sangoma Freepbx	1 Jul 202620:30	–	githubexploit

NVD

Vulners

Node

sangoma freepbxRange15.0–15.0.66

sangoma freepbxRange16.0–16.0.89

sangoma freepbxRange17.0–17.0.3

[
  {
    "vendor": "FreePBX",
    "product": "endpoint",
    "versions": [
      {
        "version": "< 15.0.66",
        "status": "affected"
      },
      {
        "version": "< 16.0.89",
        "status": "affected"
      },
      {
        "version": "< 17.0.3",
        "status": "affected"
      }
    ]
  }
]

Source	Link
community	www.community.freepbx.org/t/security-advisory-please-lock-down-your-administrator-access/107203
github	www.github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog
github	www.github.com/watchtowrlabs/watchTowr-vs-FreePBX-CVE-2025-57819

Parameter	Position	Path	Description	CWE
brand	query param	admin/ajax.php	SQL injection in FreePBX endpoint ajax path allowing unauthenticated access to manipulate the database and achieve arbitrary code execution	CWE-89, CWE-288

17 Jun 2026 15:45Current

7.5High risk

Vulners AI Score7.5

CVSS 3.19.8

CVSS 410

EPSS0.88269

SSVC

unauthenticated access sql injection remote code execution freepbx versions patched versions