FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

Sangoma FreePBX Improper Authentication Vulnerability

FreePBX Administration GUI is Vulnerable to Authenticated Command Injection

FreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injection

FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover

FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface

FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header

A vulnerability was found in FreePBX cdr 14.0

FreePBX: Authenticated API generatedocs Host Command Injection

FreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion)

Authenticated Remote Code Execution via Path Traversal in FreePBX Backup Module

FreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang Module

Authenticated Command Injection in FreePBX UCP Interface

FreePBX: Authenticated SQL Injection via ORDER BY in CDR Reports

FreePBX: Authenticated Local File Inclusion in Dashboard Module

FreePBX: Authenticated Remote Code Execution via Recordings Module AJAX Endpoints

FreePBX: Authenticated SQL Injection Vulnerabilities in FreePBX Logfiles Module

FreePBX: Authenticated SQL Injection in CDR (Call Data Record) Reports

FreePBX 16 Authenticated Remote Code Execution via API Module

FreePBX Post-Authenticated Command Injection

Sangoma Technologies FreePBX before cdr 15.0.18, 16.0.40, 15.0.16, and 16.0.17 was discovered to contain an access control issue via a modified parameter value, e.g., changing…

FreePBX: Authenticated Access can lead to Subsequent OAuth2 Authentication Bypass in API Module

Authenticated amportal search for ‘freepbx_engine’ in non root writeable directories leads to potential privilege escalation

FreePBX API has a Privilege Escalation Error in GraphQL Allowing Authenticated Users to Access Additional Scopes

FreePBX vulnerable to unauthenticated Denial of Service

FreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module

Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files

FreePBX: Command Injection leading to Remote Code Execution in FreePBX ElevenLabs Text-to-Speech integration

Authenticated SQL Injection in FreePBX tts (Text To Speech) module

A vulnerability was discovered in FreePBX 17.0.19.17

In Sangoma FreePBX 13 through 15 and sysadmin (aka System Admin) 13.0.92 through 15.0.13.6 modules have a Remote Command Execution vulnerability that results in Privilege…

FreePBX 10.13.66-32bit and 14.0.1.24 (SNG7-PBX-64bit-1712-2) allow post-authentication SQL injection via the order parameter

FreePBX: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted Backup

A vulnerability was found in FreePBX arimanager up to 13.0.5.3 and classified as problematic

An issue was discovered in Manager 13.x before 13.0.2.6 and 15.x before 15.0.6 before FreePBX 14.0.10.3

An issue was discovered in Contactmanager 13.x before 13.0.45.3, 14.x before 14.0.5.12, and 15.x before 15.0.8.21 for FreePBX 14.0.10.3

FreePBX core module vulnerable to reflected cross-site scripting via Asterisk HTTP Status page

An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13, 14, and 15 within the Call Event Logging report screen in the cel module at the…

Multiple XSS vulnerabilities exist in the Backup & Restore module \ v14.0.10.2 through v14.0.10.7 for FreePBX, as shown at /admin/config.php?display=backup on the FreePBX…

An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13, 14, and 15 within the Debug/Test page of the Superfecta module at the admin/config.php?display=superfecta…

In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the user management screen of the Administrator web site, i.e., the/admin/config.php?display=userman URI

In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the User Management screen of the Administrator web site

An issue was discovered in FreePBX core before 3.0.122.43, 14.0.18.34, and 5.0.1beta4

htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface (ARI) in FreePBX before 2.9.0.9, 2.10.x, and 2.11 before 2.11.1.5 allows remote attackers to…

admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha22 does not restrict the set of functions…

Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) context parameter to…

The callme_startcall function in recordings/misc/callme_page.php in FreePBX 2.9, 2.10, and earlier allows remote attackers to execute arbitrary commands via the callmenum…

Directory traversal vulnerability in page.recordings.php in the System Recordings component in the configuration interface in FreePBX 2.8.0 and earlier allows remote authenticated…

FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, generates different error messages for a failed login attempt depending on whether the user account exists,…

Multiple cross-site request forgery (CSRF) vulnerabilities in FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, allow remote attackers to hijack the…