737 matches found
FreePBX - Remote Code Execution
FreePBX 15, 16, and 17 contain a remote code execution caused by insufficiently sanitized user-supplied data in endpoints, letting unauthenticated attackers manipulate the database and execute code remotely, exploit requires no authentication. id: CVE-2025-57819 info: name: FreePBX - Remote Code...
FreePBX >= 17.0.2.36 && < 17.0.3 - Authenticated Command Injection
FreePBX Endpoint Manager 17.0.2.36 to = 17.0.2.36 && 17.0.3 - Authenticated Command Injection author: th3y severity: critical description: | FreePBX Endpoint Manager 17.0.2.36 to 17.0.3 contains a command injection caused by improper sanitization in filestore module's testconnection checksshconne...
CVE-2026-46516
Frogman provides headless FreePBX control. Prior to version 1.6.6, Frogman's chat-console markdown formatter assets/js/chat.js's formatMarkdown inserted regex capture groups as raw HTML in four template patterns: inline code, bold, markdown links, and download links. Tool responses that reflect...
CVE-2026-46516
CVE-2026-46516 affects Frogman (headless FreePBX control). Before v1.6.6, the chat-console markdown formatter in assets/js/chat.js (formatMarkdown) inserted regex capture groups as raw HTML in four template patterns (inline code, bold, markdown links, download links). Tool responses containing us...
EUVD-2026-45963
Frogman provides headless FreePBX control. Prior to version 1.6.6, Frogman's chat-console markdown formatter assets/js/chat.js's formatMarkdown inserted regex capture groups as raw HTML in four template patterns: inline code, bold, markdown links, and download links. Tool responses that reflect...
CVE-2026-46516 Frogman vulnerable to stored XSS in chat console formatter (escalation vector in multi-admin deployments)
Frogman provides headless FreePBX control. Prior to version 1.6.6, Frogman's chat-console markdown formatter assets/js/chat.js's formatMarkdown inserted regex capture groups as raw HTML in four template patterns: inline code, bold, markdown links, and download links. Tool responses that reflect...
security-research
security-research Personal CVE PoC repository ā exploit scrip...
PT-2026-57517
šØ CVE-2023-43336 Sangoma Technologies FreePBX before cdr 15.0.18, 16.0.40, 15.0.16, and 16.0.17 was discovered to contain an access control issue via a modified parameter value, e.g., changing extension=self to extension=101. š@cveNotify...
Exploit for SQL Injection in Sangoma Freepbx
CVE-2025-57819 Exploit Metadata - Severity: Critical...
š FreePBX SQL Injection / Shell Upload / Remote Root
This Python3 script exploits a remote SQL injection vulnerability in FreePBX and adds a remote shell that achieves root privileges. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3...
Exploit for Authentication Bypass Using an Alternate Path or Channel in Sangoma Freepbx
FreePBX CVE-2025-57819 ā Unauthenticated SQLi to Root RCE...
Exploit for Authentication Bypass Using an Alternate Path or Channel in Sangoma Freepbx
CVE-2025-57819 ā FreePBX Pre-Auth SQLi to RCE An all-in-one e...
Exploit for Authentication Bypass Using an Alternate Path or Channel in Sangoma Freepbx
FreePBX 16 ā Unauthenticated SQLi to RCE Proof-of-concept exp...
Exploit for Authentication Bypass Using an Alternate Path or Channel in Sangoma Freepbx
CVE-2025-57819 ā FreePBX Unauthenticated SQLi ā RCE One-shot...
CVE-2026-46376
FreePBX is an open source IP PBX. From 15.0.42 to before 16.0.45 and 17.0.7, unauthenticated users may be able to access the User Control Panel UCP using hard-coded initial template credentials if these were not immediately changed by the Administrator who enabled UCP. Authenticated access to ACP...
CVE-2026-40520
FreePBX api module version 17.0.8 and prior contain a command injection vulnerability in the initiateGqlAPIProcess function where GraphQL mutation input fields are passed directly to shellexec without sanitization or escaping. An authenticated user with a valid bearer token can send a GraphQL...
CVE-2026-44238
FreePBX is an open source IP PBX. Prior to 16.0.50 and 17.0.11, the CDR Reports module page allows SQL injection through the order and sort POST parameters. Authentication with a FreePBX Administration Control Panel account that has CDR section access is required. Full administrator privileges ar...
CVE-2026-44237
FreePBX is an open source IP PBX. Prior to 17.0.8, the FreePBX api module's OAuth2 implementation does not sufficiently validate client credentials during token issuance. Knowledge of a valid clientid is required. The validateClient method in ClientRepository.php unconditionally returns true,...
CVE-2026-44239
FreePBX is an open source IP PBX. Prior to 16.0.22 and 17.0.5, the Dashboard module's getcontent AJAX handler includes PHP files based on user-supplied input without path sanitization. The $REQUEST'rawname' parameter is concatenated into an include call with a .class.php suffix, allowing path...