Login Request a demo
SE
Product
security-reporting
by FreePBX · last CVE Sep 28, 2026
15
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities15In the news0Timeline
Severity mix
Critical 1High 14Medium 0Low 0
Severity
All severities15Critical1High14Medium0Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add security-reporting to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-75600
8.8
1%
Sep 28
FreePBX: Authenticated API generatedocs Host Command Injection
Affected: < 17.0.9
CVE-2026-54710
8.8
1%
Sep 28
FreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion)
Affected: < 16.0.40; < 17.0.7
CVE-2026-54708
8.8
1%
Sep 28
Authenticated Remote Code Execution via Path Traversal in FreePBX Backup Module
Affected: < 16.0.72; < 17.0.7
CVE-2026-54675
8.8
1%
Sep 28
FreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang Module
Affected: < 16.0.10; < 17.0.5
CVE-2026-54674
8.8
1%
Sep 28
Authenticated Command Injection in FreePBX UCP Interface
Affected: < 16.0.39; < 17.0.7
CVE-2026-44238
8.8
0%
May 29
FreePBX: Authenticated SQL Injection via ORDER BY in CDR Reports
Affected: < 16.0.50; >= 17.0.1, < 17.0.11
CVE-2026-44239
8.8
0%
May 29
FreePBX: Authenticated Local File Inclusion in Dashboard Module
Affected: < 16.0.22; >= 17.0.1, < 17.0.5
CVE-2026-28287
8.8
9%
Mar 5
FreePBX: Authenticated Remote Code Execution via Recordings Module AJAX Endpoints
Affected: >= 16.0.17.2, < 16.0.20; >= 17.0.2.4, < 17.0.5
CVE-2026-28284
8.8
0%
Mar 5
FreePBX: Authenticated SQL Injection Vulnerabilities in FreePBX Logfiles Module
Affected: < 16.0.10; < 17.0.5
CVE-2026-28210
8.8
0%
Mar 5
FreePBX: Authenticated SQL Injection in CDR (Call Data Record) Reports
Affected: < 16.0.49; < 17.0.7
CVE-2026-26978
8.6
1%
May 18
Free PBX backup: Deserialization of Untrusted Data in admin/modules/backup/Models/BackupSplFileInfo.php
Affected: < 16.0.71; >= 17.0.0, < 17.0.6
CVE-2026-44237
8.1
3%
May 29
FreePBX: Authenticated Access can lead to Subsequent OAuth2 Authentication Bypass in API Module
Affected: < 17.0.8
CVE-2026-45562
7.2
0%
Sep 28
FreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module
Affected: < 16.0.4; < 17.0.6
CVE-2026-28209
7.2
1%
Mar 5
FreePBX: Command Injection leading to Remote Code Execution in FreePBX ElevenLabs Text-to-Speech integration
Affected: >= 16.0.17.2, < 16.0.20; >= 17.0.2.4, < 17.0.5
Showing 14