Login Request a demo
FR
Vendor
FreePBX
19 products with CVEs on record
54
CVEs
2
On KEV
0
New 30D
Products
EN
endpoint
FreePBX
9.8
4 CVEs1 on KEV0 new
FI
filestore
FreePBX
7.2
1 CVEs1 on KEV0 new
SE
security-reporting
FreePBX
9.8
15 CVEs0 on KEV0 new
FR
FreePBX
FreePBX
8.8
10 CVEs0 on KEV0 new
FR
framework
FreePBX
9.8
5 CVEs0 on KEV0 new
AP
api
FreePBX
8.8
3 CVEs0 on KEV0 new
CO
contactmanager
FreePBX
6.1
2 CVEs0 on KEV0 new
EN
endpointman
FreePBX
8.6
2 CVEs0 on KEV0 new
TT
tts
FreePBX
7.5
2 CVEs0 on KEV0 new
BA
backup
FreePBX
8.6
1 CVEs0 on KEV0 new
CO
core
FreePBX
5.4
1 CVEs0 on KEV0 new
DI
Disa
Freepbx
4.3
1 CVEs0 on KEV0 new
EM
Endpoint Manager
Freepbx
6.8
1 CVEs0 on KEV0 new
FF
FreePBX Framework
FreePBX
8.8
1 CVEs0 on KEV0 new
MA
Manager
Freepbx
6.1
1 CVEs0 on KEV0 new
MI
missedcall
FreePBX
9.8
1 CVEs0 on KEV0 new
MU
music
FreePBX
7.2
1 CVEs0 on KEV0 new
RE
restapps
FreePBX
8.6
1 CVEs0 on KEV0 new
UC
ucp
FreePBX
9.8
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-75600
SE
security-reporting
FreePBX
8.8
1%
Sep 28FreePBX: Authenticated API generatedocs Host Command Injection
CVE-2026-54710
SE
security-reporting
FreePBX
8.8
1%
Sep 28FreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion)
CVE-2026-54708
SE
security-reporting
FreePBX
8.8
1%
Sep 28Authenticated Remote Code Execution via Path Traversal in FreePBX Backup Module
CVE-2026-54675
SE
security-reporting
FreePBX
8.8
1%
Sep 28FreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang Module
CVE-2026-54674
SE
security-reporting
FreePBX
8.8
1%
Sep 28Authenticated Command Injection in FreePBX UCP Interface
CVE-2026-45562
SE
security-reporting
FreePBX
7.2
0%
Sep 28FreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module
CVE-2026-73665
UC
ucp
FreePBX
9.8
0%
Aug 13FreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injection
CVE-2026-73664
BA
backup
FreePBX
8.6
1%
Aug 13FreePBX: Authenticated Arbitrary SSH Key Injection via Backup Module
CVE-2026-73663
MI
missedcall
FreePBX
9.8
0%
Aug 13FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover
CVE-2026-73662
MU
music
FreePBX
7.2
1%
Aug 13Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files
CVE-2026-73661
FR
framework
FreePBX
6.5
0%
Aug 13FreePBX: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted Backup
CVE-2026-73660
TT
tts
FreePBX
7.5
1%
Aug 13FreePBX: Authenticated TTS AGI Command Injection Through TTS Name
CVE-2026-72578
FF
FreePBX Framework
FreePBX
8.8
0%
Aug 10FreePBX Framework - Missing CSRF Protection in Admin Panel Ajax Dispatcher
CVE-2026-44237
SE
security-reporting
FreePBX
8.1
3%
May 29FreePBX: Authenticated Access can lead to Subsequent OAuth2 Authentication Bypass in API Module
CVE-2026-44238
SE
security-reporting
FreePBX
8.8
0%
May 29FreePBX: Authenticated SQL Injection via ORDER BY in CDR Reports
CVE-2026-44239
SE
security-reporting
FreePBX
8.8
0%
May 29FreePBX: Authenticated Local File Inclusion in Dashboard Module
CVE-2026-46376
SE
security-reporting
FreePBX
9.8
0%
May 29FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface
CVE-2026-26978
SE
security-reporting
FreePBX
8.6
1%
May 18Free PBX backup: Deserialization of Untrusted Data in admin/modules/backup/Models/BackupSplFileInfo.php
CVE-2026-40520
AP
api
FreePBX
8.8
1%
Apr 21FreePBX api module Command Injection via GraphQL
CVE-2026-28287
SE
security-reporting
FreePBX
8.8
9%
Mar 5FreePBX: Authenticated Remote Code Execution via Recordings Module AJAX Endpoints
CVE-2026-28284
SE
security-reporting
FreePBX
8.8
0%
Mar 5FreePBX: Authenticated SQL Injection Vulnerabilities in FreePBX Logfiles Module
CVE-2026-28210
SE
security-reporting
FreePBX
8.8
0%
Mar 5FreePBX: Authenticated SQL Injection in CDR (Call Data Record) Reports
CVE-2026-28209
SE
security-reporting
FreePBX
7.2
1%
Mar 5FreePBX: Command Injection leading to Remote Code Execution in FreePBX ElevenLabs Text-to-Speech integration
CVE-2025-55210
AP
api
FreePBX
7.5
0%
Feb 12FreePBX API has a Privilege Escalation Error in GraphQL Allowing Authenticated Users to Access Additional Scopes
CVE-2025-67736
TT
tts
FreePBX
7.2
6%
Dec 16Authenticated SQL Injection in FreePBX tts (Text To Speech) module
CVE-2025-67722
FR
framework
FreePBX
7.8
0%
Dec 16Authenticated amportal search for ‘freepbx_engine’ in non root writeable directories leads to potential privilege escalation
CVE-2024-58294
FR
FreePBX
FreePBX
8.8
4%
Dec 11FreePBX 16 Authenticated Remote Code Execution via API Module
CVE-2025-67513
EN
endpoint
FreePBX
6.9
0%
Dec 10FreePBX Endpoint Manager's Weak Default Password Allows Unauthenticated Access in Endpoint Module REST API
CVE-2025-66039
FR
framework
FreePBX
9.8
3%
Dec 9FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header
CVE-2025-62173
RE
restapps
FreePBX
8.6
0%
Dec 3Authenticated SQL Injection in Endpoint Module Rest API
CVE-2025-64328
In wildKEV
FI
filestore
FreePBX
7.2
85%
Nov 7FreePBX Administration GUI is Vulnerable to Authenticated Command Injection
CVE-2025-61678
EN
endpointman
FreePBX
8.6
44%
Oct 14FreePBX Endpoint Manager vulnerable to authenticated arbitrary file upload via fwbrand parameter
CVE-2025-61675
EN
endpoint
FreePBX
8.6
39%
Oct 14FreePBX Endpoint Manager vulnerable to authenticated SQL injection in multiple configuration parameters
CVE-2025-59429
CO
core
FreePBX
5.4
0%
Oct 14FreePBX core module vulnerable to reflected cross-site scripting via Asterisk HTTP Status page
CVE-2025-59051
EN
endpoint
FreePBX
8.6
1%
Oct 14FreePBX Endpoint Manager command injection via Network Scanning feature
CVE-2025-59056
FR
framework
FreePBX
7.5
0%
Sep 15FreePBX vulnerable to unauthenticated Denial of Service
CVE-2025-55211
FR
framework
FreePBX
8.8
0%
Sep 15FreePBX Post-Authenticated Command Injection
CVE-2025-55739
AP
api
FreePBX
5.1
0%
Sep 4api: Shared OAuth Signing Key Between Different Instances
CVE-2025-55209
CO
contactmanager
FreePBX
5.1
0%
Sep 4FreePBX UCP is Vulnerable to Stored XSS Through its User Control Panel
CVE-2025-57819
In wildKEV
EN
endpoint
FreePBX
9.8
95%
Aug 28FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
CVE-2024-47071
EN
endpointman
FreePBX
6.8
1%
Oct 1OSS Endpoint Manager allows unauthorized access to read system files
CVE-2019-16967
MA
Manager
Freepbx
6.1
1%
Oct 21An issue was discovered in Manager 13.x before 13.0.2.6 and 15.x before 15.0.6 before FreePBX 14.0.10.3
CVE-2019-16966
CO
Contactmanager
Freepbx
6.1
1%
Oct 21An issue was discovered in Contactmanager 13.x before 13.0.45.3, 14.x before 14.0.5.12, and 15.x before 15.0.8.21 for FreePBX 14.0.10.3
CVE-2018-15892
DI
Disa
Freepbx
4.3
1%
Jun 20FreePBX 13 and 14 has SQL Injection in the DISA module via the hangup variable on the /admin/config.php?display=disa&view=form page
CVE-2018-15891
FR
Freepbx
Freepbx
4.8
1%
Jun 20An issue was discovered in FreePBX core before 3.0.122.43, 14.0.18.34, and 5.0.1beta4
CVE-2014-7235
FR
Freepbx
Freepbx
–
44%
Oct 7htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface (ARI) in FreePBX before 2.9.0.9, 2.10.x, and 2.11 before 2.11.1.5 allows remote attackers to…
CVE-2014-1903
FR
Freepbx
Freepbx
–
52%
Feb 18admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha22 does not restrict the set of functions…
CVE-2009-4458
FR
Freepbx
Freepbx
–
2%
Dec 30Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.5.2 and 2.6.0rc2, and possibly other versions, allow remote attackers to inject arbitrary web script or HTML via…
CVE-2009-1803
FR
Freepbx
Freepbx
–
1%
May 28FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, generates different error messages for a failed login attempt depending on whether the user account exists,…
CVE-2009-1802
FR
Freepbx
Freepbx
–
1%
May 28Multiple cross-site request forgery (CSRF) vulnerabilities in FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, allow remote attackers to hijack the…
CVE-2009-1801
FR
Freepbx
Freepbx
–
1%
May 28Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, allow remote attackers to inject arbitrary web script…
CVE-2007-2350
FR
Freepbx
Freepbx
–
2%
Apr 30admin/config.php in the music-on-hold module in freePBX 2.2.x allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the del…
CVE-2007-2191
FR
Freepbx
Freepbx
–
4%
Apr 24Multiple cross-site scripting (XSS) vulnerabilities in freePBX 2.2.x allow remote attackers to inject arbitrary web script or HTML via the (1) From, (2) To, (3) Call-ID, (4)…