EUVD-2025-34454

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17, the Endpoint Manager module contains authenticated SQL injection vulnerabilities affecting multiple parameters in the...

CVE-2025-61675

CVE-2025-61675 affects FreePBX Endpoint Manager in FreePBX 16 (before 16.0.92) and FreePBX 17 (before 17.0.6). It describes authenticated SQL injections across multiple parameters (basestation, model, firmware, custom extension config). An attacker with a known username can exploit to execute arb...

CVE-2025-59429 FreePBX core module vulnerable to reflected cross-site scripting via Asterisk HTTP Status page

FreePBX is an open source GUI for managing Asterisk. In versions prior to 16.0.68.39 for FreePBX 16 and versions prior to 17.0.18.38 for FreePBX 17, a reflected cross-site scripting vulnerability is present on the Asterisk HTTP Status page. The Asterisk HTTP status page is exposed by FreePBX and ...

EUVD-2025-34469

FreePBX is an open source GUI for managing Asterisk. In versions prior to 16.0.68.39 for FreePBX 16 and versions prior to 17.0.18.38 for FreePBX 17, a reflected cross-site scripting vulnerability is present on the Asterisk HTTP Status page. The Asterisk HTTP status page is exposed by FreePBX and ...

CVE-2025-59429

FreePBX is an open source GUI for managing Asterisk. In versions prior to 16.0.68.39 for FreePBX 16 and versions prior to 17.0.18.38 for FreePBX 17, a reflected cross-site scripting vulnerability is present on the Asterisk HTTP Status page. The Asterisk HTTP status page is exposed by FreePBX and ...

CVE-2025-59429

CVE-2025-59429 affects FreePBX core: reflected XSS on the Asterisk HTTP Status page. Affected: FreePBX 16 < 16.0.68.39 (port 8088 exposed by default) and FreePBX 17

CVE-2025-59429 FreePBX core module vulnerable to reflected cross-site scripting via Asterisk HTTP Status page

FreePBX is an open source GUI for managing Asterisk. In versions prior to 16.0.68.39 for FreePBX 16 and versions prior to 17.0.18.38 for FreePBX 17, a reflected cross-site scripting vulnerability is present on the Asterisk HTTP Status page. The Asterisk HTTP status page is exposed by FreePBX and ...

CVE-2025-59429 FreePBX core module vulnerable to reflected cross-site scripting via Asterisk HTTP Status page

FreePBX is an open source GUI for managing Asterisk. In versions prior to 16.0.68.39 for FreePBX 16 and versions prior to 17.0.18.38 for FreePBX 17, a reflected cross-site scripting vulnerability is present on the Asterisk HTTP Status page. The Asterisk HTTP status page is exposed by FreePBX and ...

EUVD-2025-34482

The FreePBX Endpoint Manager module includes a Network Scanning feature that provides web-based access to nmap functionality for network device discovery. In Endpoint Manager 16 before 16.0.92 and 17 before 17.0.6, insufficiently sanitized user-supplied input allows authenticated OS command...

CVE-2025-59051

The FreePBX Endpoint Manager module includes a Network Scanning feature that provides web-based access to nmap functionality for network device discovery. In Endpoint Manager 16 before 16.0.92 and 17 before 17.0.6, insufficiently sanitized user-supplied input allows authenticated OS command...

CVE-2025-59051 FreePBX Endpoint Manager command injection via Network Scanning feature

The FreePBX Endpoint Manager module includes a Network Scanning feature that provides web-based access to nmap functionality for network device discovery. In Endpoint Manager 16 before 16.0.92 and 17 before 17.0.6, insufficiently sanitized user-supplied input allows authenticated OS command...

CVE-2025-59051 FreePBX Endpoint Manager command injection via Network Scanning feature

The FreePBX Endpoint Manager module includes a Network Scanning feature that provides web-based access to nmap functionality for network device discovery. In Endpoint Manager 16 before 16.0.92 and 17 before 17.0.6, insufficiently sanitized user-supplied input allows authenticated OS command...

CVE-2025-59051 FreePBX Endpoint Manager command injection via Network Scanning feature

The FreePBX Endpoint Manager module includes a Network Scanning feature that provides web-based access to nmap functionality for network device discovery. In Endpoint Manager 16 before 16.0.92 and 17 before 17.0.6, insufficiently sanitized user-supplied input allows authenticated OS command...

CVE-2025-59051

Summary: CVE-2025-59051 affects FreePBX Endpoint Manager. The vulnerability arises from the Network Scanning feature, which exposes web-based access to nmap functionality. In Endpoint Manager versions prior to 16.0.92 and 17 prior to 17.0.6, insufficient input sanitization allows an authenticated...

PT-2025-42186

Name of the Vulnerable Software and Affected Versions FreePBX Endpoint Manager versions prior to 16.0.92 FreePBX Endpoint Manager versions prior to 17.0.6 Description The FreePBX Endpoint Manager module contains an authenticated arbitrary file upload issue. The fwbrand parameter allows an attacke...

PT-2025-42181

Name of the Vulnerable Software and Affected Versions FreePBX Endpoint Manager versions prior to 16.0.92 FreePBX Endpoint Manager versions prior to 17.0.6 Description The software includes a Network Scanning feature that provides web-based access to nmap functionality for network device discovery...

FreePBX Endpoint Manager SQL注入漏洞

FreePBX Endpoint Manager is a centralized IP phone endpoint configuration module from FreePBX open source. An SQL injection vulnerability exists in FreePBX Endpoint Manager versions prior to 16.0.92 and 17.0.6. The vulnerability stems from an SQL injection vulnerability in multiple parameters in...

PT-2025-42185

Name of the Vulnerable Software and Affected Versions FreePBX Endpoint Manager versions prior to 16.0.92 FreePBX Endpoint Manager versions prior to 17.0.6 Description The FreePBX Endpoint Manager module contains authenticated SQL injection vulnerabilities affecting multiple parameters in the...

FreePBX Endpoint Manager 操作系统命令注入漏洞

FreePBX Endpoint Manager is a centralized IP phone endpoint configuration module from the FreePBX open source. An operating system command injection vulnerability exists in FreePBX Endpoint Manager versions prior to 16.0.92 and prior to 17.0.6, which stems from insufficient user input cleanup, an...

FreePBX Endpoint Manager 代码问题漏洞

FreePBX Endpoint Manager is a FreePBX open source endpoint configuration module for centralized management of IP phones. A code issue vulnerability exists in FreePBX Endpoint Manager versions prior to 16.0.92 and 17.0.6, which stems from the presence of an authenticated arbitrary file upload in t...