CVE-2026-46376

CVE-2026-46376 — Accesso UCP non autenticato su FreePBX tramite credenziali hard-coded Una vulnerabilità critica nel modulo User Management userman di FreePBX consente a utenti non autenticati di accedere al Pannello di Controllo Utente UCP utilizzando credenziali hard-coded che vengono incorpora...

lab-cve-2025-57819

Lavori in corso FreePBX CVE-2025-57819 Lab - SQLi non autenticata → Catena RCE Nuclei POC Avvia un laboratorio FreePBX 15 riproducibile Docker per validare CVE-2025-57819 — una critica SQL injection non autenticata negli endpoint AJAX di userman che può essere concatenata per ottenere RCE. Includ...

Exploit for CVE-2026-46376

CVE-2026-46376 — FreePBX Unauthenticated UCP Access via Hard-C...

Exploit for SQL Injection in Sangoma Freepbx

Work in Progress FreePBX CVE-2025-57819 Lab - Unauth SQLi →...

CVE-2019-19551

In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the User Management screen of the Administrator web site. An attacker with access to the User Control Panel application can submit malicious values in some of the time/date formatting and time-zone fields. These fields are no...

Cross site scripting

In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the user management screen of the Administrator web site, i.e., the/admin/config.php?display=userman URI. An attacker with sufficient privileges can edit the Display Name of a user and embed malicious XSS code. When another...

CVE-2019-19551

The CVE-2019-19551 entry describes an XSS vulnerability in Sangoma FreePBX’s Userman, affecting versions 13.0.76.43 through 15.0.20. The issue arises from insufficient sanitization of time/date formatting and time-zone fields in the User Management screen. An attacker with access to the User Cont...

CVE-2019-19552

In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the user management screen of the Administrator web site, i.e., the/admin/config.php?display=userman URI. An attacker with sufficient privileges can edit the Display Name of a user and embed malicious XSS code. When another...

CVE-2009-1749

Multiple cross-site scripting XSS vulnerabilities in index.php in Catviz 0.4.0 beta 1 allow remote attackers to inject arbitrary web script or HTML via the 1 usermanform and 2 webpagesform parameters...

CVE-2009-1749

Multiple cross-site scripting XSS vulnerabilities in index.php in Catviz 0.4.0 beta 1 allow remote attackers to inject arbitrary web script or HTML via the 1 usermanform and 2 webpagesform parameters...

phpEventMan 1.0.2 - level Remote File Inclusion

phpEventMan 1.0.2 - level Remote File Inclusion ----------------------------------------------- phpEventMan v1.0.2 level Remote File Include Exploit ----------------------------------------------- Author: Cyber-Security cyber-security.org ----------------------------------------------- Code:...

phpEventMan 1.0.2 - 'level' Remote File Inclusion

----------------------------------------------- phpEventMan v1.0.2 level Remote File Include Exploit ----------------------------------------------- Author: Cyber-Security cyber-security.org ----------------------------------------------- Code:...