CVE-2026-73663

creationtimestamp| type| source ---|---|--- 2026-08-13 22:30:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msyozht35o25 2026-08-15 13:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mt4rrnxe7j2y...

CVE-2026-73663 FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover

FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound Caller ID name from crafted SIP From headers into the missedcalllog INSERT in agi-bin/missedcallnotify.php without escaping or bound parameters. An unauthenticated caller can...

CVE-2026-73663

The CVE concerns FreePBX missedcall module (affected in 16.0.0–16.0.11 and 17.0.4) where inbound Caller ID name from crafted SIP From headers is inserted into missedcalllog without escaping or bound parameters, enabling unauthenticated SQL injection that can corrupt the database and modify admini...