CVE-2026-73662

FreePBX is an open source IP PBX. From 17.0.1 until 17.0.7, the FreePBX Music on Hold module permits dangerous command-line options for /usr/bin/mpg123 and other allowed players in validateCustomConfiguration in Music.class.php. An authenticated administrator can use options that write files, ope...

CVE-2026-73662 Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files

FreePBX is an open source IP PBX. From 17.0.1 until 17.0.7, the FreePBX Music on Hold module permits dangerous command-line options for /usr/bin/mpg123 and other allowed players in validateCustomConfiguration in Music.class.php. An authenticated administrator can use options that write files, ope...

EUVD-2007-2345

Malware in sbrugna...

Code injection

admin/config.php in the music-on-hold module in freePBX 2.2.x allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the del parameter...

CVE-2007-2350

admin/config.php in the music-on-hold module in freePBX 2.2.x allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the del parameter...

CVE-2007-2350

The CVE concerns admin/config.php in the music-on-hold module of freePBX 2.2.x. It allows a remote authenticated administrator to execute arbitrary commands via shell metacharacters in the del parameter, indicating input handling/sanitization flaws in that file. Impact is potential remote command...