FR
Product
FreePBX
On CISA KEVExploited in the wild
51
CVEs
3
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 25Medium 11Low 0
Watch
Add FreePBX to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-57819 In wildKEV | 9.8 | Aug 28 | FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE Affected: 15.0 before 15.0.66; 16.0 before 16.0.89; 17.0 before 17.0.3 |
| CVE-2019-19006 In wildKEV | 9.8 | Nov 21 | Sangoma FreePBX Improper Authentication Vulnerability Affected: 13.0.0.0 through 13.0.197.13; 14.0.0.0 through 14.0.13.11; 15.0.0.0 through 15.0.16.26 |
| CVE-2026-73665 | 9.8 | Aug 13 | FreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injection Affected: before 17.0.9 |
| CVE-2026-73663 | 9.8 | Aug 13 | FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover Affected: 16.0 before 16.0.11; 17.0 before 17.0.4 |
| CVE-2026-46376 | 9.8 | May 29 | FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface Affected: before 16.0.45; 17.0 before 17.0.7 |
| CVE-2025-66039 | 9.8 | Dec 9 | FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header Affected: before 16.0.44; 17.0.1 before 17.0.23 |
| CVE-2020-36630 | 9.8 | Dec 25 | A vulnerability was found in FreePBX cdr 14.0 Affected: 14.0 before 14.0.5.21 |
Showing 7