Login Request a demo
FR
Product
FreePBX
by Sangoma · last CVE Sep 28, 2026
On CISA KEVExploited in the wild
51
CVEs
3
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities51In the news2Timeline
Severity mix
Critical 7High 25Medium 11Low 0
Severity
All severities51Critical7High25Medium11Low0
Exploitation
On CISA KEV3Exploited in the wild3
Watch

Add FreePBX to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-73661
6.5
0%
Aug 13
FreePBX: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted Backup
Affected: 16.0 before 16.0.47; 17.0 before 17.0.30
CVE-2019-25090
6.1
1%
Dec 27
A vulnerability was found in FreePBX arimanager up to 13.0.5.3 and classified as problematic
Affected: before 13.0.5.4
CVE-2019-16967
6.1
1%
Oct 21
An issue was discovered in Manager 13.x before 13.0.2.6 and 15.x before 15.0.6 before FreePBX 14.0.10.3
Affected: before 14.0.10.3
CVE-2019-16966
6.1
1%
Oct 21
An issue was discovered in Contactmanager 13.x before 13.0.45.3, 14.x before 14.0.5.12, and 15.x before 15.0.8.21 for FreePBX 14.0.10.3
Affected: 14.0.10.3
CVE-2025-59429
5.4
0%
Oct 14
FreePBX core module vulnerable to reflected cross-site scripting via Asterisk HTTP Status page
Affected: before 16.0.68.39; 17.0.1 before 17.0.18.38
CVE-2019-19852
4.8
1%
Mar 16
An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13, 14, and 15 within the Call Event Logging report screen in the cel module at the…
Affected: 13.0 through 13.0.26.9; 14.0 through 14.0.2.14; 15.0 through 15.0.15.4
CVE-2019-19615
4.8
1%
Mar 16
Multiple XSS vulnerabilities exist in the Backup & Restore module \ v14.0.10.2 through v14.0.10.7 for FreePBX, as shown at /admin/config.php?display=backup on the FreePBX…
Affected: 14.0.10.2 through 14.0.10.7
CVE-2019-19851
4.8
1%
Mar 16
An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13, 14, and 15 within the Debug/Test page of the Superfecta module at the admin/config.php?display=superfecta…
Affected: through 13.0.4.7; 14.0.0.0 through 14.0.24; 15.0.0.0 through 15.0.2.20
CVE-2019-19552
4.8
1%
Dec 6
In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the user management screen of the Administrator web site, i.e., the/admin/config.php?display=userman URI
Affected: 13.0 through 13.0.76.43; 14.0 through 14.0.7; 15.0 through 15.0.20
CVE-2019-19551
4.8
1%
Dec 6
In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the User Management screen of the Administrator web site
Affected: 13.0 through 13.0.76.43; 14.0 through 14.0.7; 15.0 through 15.0.20
CVE-2018-15891
4.8
1%
Jun 20
An issue was discovered in FreePBX core before 3.0.122.43, 14.0.18.34, and 5.0.1beta4
Affected: before 13.0.122.43; 14.0.0 before 14.0.18.34; 15.0.0 through 15.0.1; 15.0.1
Showing 11