CVE-2026-46376

CVE-2026-46376 — FreePBX Unauthenticated UCP Access via Hard-Coded Credentials A critical vulnerability in FreePBX's User Management userman module allows unauthenticated attackers to access the User Control Panel UCP using hard-coded credentials that are embedded during the UCP generic template...

CVE-2026-54674 Authenticated Command Injection in FreePBX UCP Interface

FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel UCP are able to execute arbitrary commands on the PBX as the webserver user typically asterisk using specially crafted HTTP strings. Authenticated access to UCP is required. Note tha...

CVE-2026-73665 FreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injection

FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.usecheckAuth in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to custom namespaces that do not...

CVE-2026-73665

FreePBX UCP vulnerability affecting versions prior to 17.0.9. The UCP Node server (ports 8001/8003) uses io.use(checkAuth) but Socket.IO v4 applies that middleware only to the default namespace, allowing an unauthenticated client to reach custom namespaces. This can lead to crafted AMI actions th...

CVE-2026-73665: Missing Authorization

FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.usecheckAuth in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to custom namespaces that do not...

Exploit for CVE-2026-46376

CVE-2026-46376 — FreePBX Unauthenticated UCP Access via Hard-C...

CVE-2025-55209 FreePBX UCP is Vulnerable to Stored XSS Through its User Control Panel

contactmanager is a module for FreePBX@, which is an open source GUI that controls and manages Asterisk© PBX. In versions 15.0.14 and below, 16.0.0 through 16.0.26.4 and 17.0.0 through 17.0.5, a stored cross-site scripting XSS vulnerability in FreePBX allows a low-privileged User Control Panel UC...

CVE-2025-55209

contactmanager is a module for FreePBX@, which is an open source GUI that controls and manages Asterisk© PBX. In versions 15.0.14 and below, 16.0.0 through 16.0.26.4 and 17.0.0 through 17.0.5, a stored cross-site scripting XSS vulnerability in FreePBX allows a low-privileged User Control Panel UC...

CVE-2025-55209

The CVE-2025-55209 entry describes a stored XSS in the FreePBX contactmanager module affecting FreePBX/UCP. Affected versions are 15.0.14 and earlier, 16.0.0–16.0.26.4, and 17.0.0–17.0.5. The vulnerability allows a low-privileged UCP user to inject JavaScript that executes in the administrator’s ...

The vulnerability of the isUCPCameraNameChanged function in the /sbin/ucp file of the D-Link DCS-932L microprogrammed IP camera allows a intruder to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the isUCPCameraNameChanged function in the /sbin/ucp file of the D-Link DCS-932L microprogrammed camera software is related to buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility o...

CVE-2025-4842

A vulnerability was found in D-Link DCS-932L 2.18.01. It has been declared as critical. This vulnerability affects the function isUCPCameraNameChanged of the file /sbin/ucp. The manipulation of the argument CameraName leads to stack-based buffer overflow. The attack can be initiated remotely. The...

CVE-2025-4842: Stack-based Buffer Overflow

A vulnerability was found in D-Link DCS-932L 2.18.01. It has been declared as critical. This vulnerability affects the function isUCPCameraNameChanged of the file /sbin/ucp. The manipulation of the argument CameraName leads to stack-based buffer overflow. The attack can be initiated remotely. The...

PT-2023-16555

Name of the Vulnerable Software and Affected Versions Under Construction plugin for WordPress versions up to and including 3.96 Description The issue arises from missing or incorrect nonce validation on the dismiss notice function, which is called via the admin action ucp dismiss notice action...

Sql injection

A vulnerability was found in FreePBX cdr 14.0. It has been classified as critical. This affects the function ajaxHandler of the file ucp/Cdr.class.php. The manipulation of the argument limit/offset leads to sql injection. Upgrading to version 14.0.5.21 is able to address this issue. The name of t...

CVE-2020-36630

FreePBX cdr 14.0 is affected by a SQL injection in the ajaxHandler function of ucp/Cdr.class.php through manipulation of the limit/offset parameter. The issue is resolved by upgrading to version 14.0.5.21, with the patch identified as f1a9eea2dfff30fb99d825bac194a676a82b9ec8. Connected sources co...

FreePBX SQL注入漏洞

FreePBX formerly known as Asterisk Management Portal is a set of tools from the FreePBX project for configuring Asterisk IP telephony system through a GUI web-based graphical interface. A SQL injection vulnerability exists in FreePBX cdr versions prior to 14.0.5.21, which stems from a problem wit...

ucp-slo.org Improper Access Control vulnerability OBB-2174718

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2018-5694

The callforward module in User Control Panel UCP in Nicolas Gudino aka Asternic Flash Operator Panel FOP 2.31.03 allows remote authenticated users to execute arbitrary commands via the command parameter...

CVE-2018-5694

The CVE-2018-5694 entry corresponds to a command injection vulnerability in the callforward module of the User Control Panel (UCP) within Nicolas Gudino’s Flash Operator Panel (FOP) version 2.31.03. A remote authenticated user can exploit the vulnerability by supplying a crafted value to the comm...

PT-2018-17091

Name of the Vulnerable Software and Affected Versions: Flash Operator Panel FOP version 2.31.03 Description: The issue allows remote authenticated users to execute arbitrary commands. This is possible due to a flaw in the callforward module in the User Control Panel UCP. The command parameter is...