Login Request a demo
FR
Vendor
FreePBX
15 products with CVEs on record
38
CVEs
2
On KEV
6
New 30D
Products
SE
security-reporting
FreePBX
9.8
15 CVEs0 on KEV6 new
EN
endpoint
FreePBX
9.8
1 CVEs1 on KEV0 new
FI
filestore
FreePBX
7.2
1 CVEs1 on KEV0 new
FR
Freepbx
Freepbx
4.8
9 CVEs0 on KEV0 new
AP
api
FreePBX
8.8
2 CVEs0 on KEV0 new
BA
backup
FreePBX
8.6
1 CVEs0 on KEV0 new
CO
Contactmanager
Freepbx
6.1
1 CVEs0 on KEV0 new
DI
Disa
Freepbx
4.3
1 CVEs0 on KEV0 new
FR
framework
FreePBX
6.5
1 CVEs0 on KEV0 new
FF
FreePBX Framework
FreePBX
8.8
1 CVEs0 on KEV0 new
MA
Manager
Freepbx
6.1
1 CVEs0 on KEV0 new
MI
missedcall
FreePBX
9.8
1 CVEs0 on KEV0 new
MU
music
FreePBX
7.2
1 CVEs0 on KEV0 new
TT
tts
FreePBX
7.5
1 CVEs0 on KEV0 new
UC
ucp
FreePBX
9.8
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-75600
SE
security-reporting
FreePBX
8.8
1%
Sep 28FreePBX: Authenticated API generatedocs Host Command Injection
CVE-2026-54710
SE
security-reporting
FreePBX
8.8
1%
Sep 28FreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion)
CVE-2026-54708
SE
security-reporting
FreePBX
8.8
1%
Sep 28Authenticated Remote Code Execution via Path Traversal in FreePBX Backup Module
CVE-2026-54675
SE
security-reporting
FreePBX
8.8
1%
Sep 28FreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang Module
CVE-2026-54674
SE
security-reporting
FreePBX
8.8
1%
Sep 28Authenticated Command Injection in FreePBX UCP Interface
CVE-2026-45562
SE
security-reporting
FreePBX
7.2
0%
Sep 28FreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module
CVE-2026-73665
UC
ucp
FreePBX
9.8
0%
Aug 13FreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injection
CVE-2026-73664
BA
backup
FreePBX
8.6
1%
Aug 13FreePBX: Authenticated Arbitrary SSH Key Injection via Backup Module
CVE-2026-73663
MI
missedcall
FreePBX
9.8
0%
Aug 13FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover
CVE-2026-73662
MU
music
FreePBX
7.2
1%
Aug 13Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files
CVE-2026-73661
FR
framework
FreePBX
6.5
0%
Aug 13FreePBX: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted Backup
CVE-2026-73660
TT
tts
FreePBX
7.5
1%
Aug 13FreePBX: Authenticated TTS AGI Command Injection Through TTS Name
CVE-2026-72578
FF
FreePBX Framework
FreePBX
8.8
0%
Aug 10FreePBX Framework - Missing CSRF Protection in Admin Panel Ajax Dispatcher
CVE-2026-44237
SE
security-reporting
FreePBX
8.1
3%
May 29FreePBX: Authenticated Access can lead to Subsequent OAuth2 Authentication Bypass in API Module
CVE-2026-44238
SE
security-reporting
FreePBX
8.8
0%
May 29FreePBX: Authenticated SQL Injection via ORDER BY in CDR Reports
CVE-2026-44239
SE
security-reporting
FreePBX
8.8
0%
May 29FreePBX: Authenticated Local File Inclusion in Dashboard Module
CVE-2026-46376
SE
security-reporting
FreePBX
9.8
0%
May 29FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface
CVE-2026-26978
SE
security-reporting
FreePBX
8.6
1%
May 18Free PBX backup: Deserialization of Untrusted Data in admin/modules/backup/Models/BackupSplFileInfo.php
CVE-2026-40520
AP
api
FreePBX
8.8
1%
Apr 21FreePBX api module Command Injection via GraphQL
CVE-2026-28287
SE
security-reporting
FreePBX
8.8
9%
Mar 5FreePBX: Authenticated Remote Code Execution via Recordings Module AJAX Endpoints
CVE-2026-28284
SE
security-reporting
FreePBX
8.8
0%
Mar 5FreePBX: Authenticated SQL Injection Vulnerabilities in FreePBX Logfiles Module
CVE-2026-28210
SE
security-reporting
FreePBX
8.8
0%
Mar 5FreePBX: Authenticated SQL Injection in CDR (Call Data Record) Reports
CVE-2026-28209
SE
security-reporting
FreePBX
7.2
1%
Mar 5FreePBX: Command Injection leading to Remote Code Execution in FreePBX ElevenLabs Text-to-Speech integration
CVE-2025-55210
AP
api
FreePBX
7.5
0%
Feb 12FreePBX API has a Privilege Escalation Error in GraphQL Allowing Authenticated Users to Access Additional Scopes
CVE-2025-64328
In wildKEV
FI
filestore
FreePBX
7.2
85%
Nov 7FreePBX Administration GUI is Vulnerable to Authenticated Command Injection
CVE-2025-57819
In wildKEV
EN
endpoint
FreePBX
9.8
95%
Aug 28FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
CVE-2019-16967
MA
Manager
Freepbx
6.1
1%
Oct 21An issue was discovered in Manager 13.x before 13.0.2.6 and 15.x before 15.0.6 before FreePBX 14.0.10.3
CVE-2019-16966
CO
Contactmanager
Freepbx
6.1
1%
Oct 21An issue was discovered in Contactmanager 13.x before 13.0.45.3, 14.x before 14.0.5.12, and 15.x before 15.0.8.21 for FreePBX 14.0.10.3
CVE-2018-15892
DI
Disa
Freepbx
4.3
1%
Jun 20FreePBX 13 and 14 has SQL Injection in the DISA module via the hangup variable on the /admin/config.php?display=disa&view=form page
CVE-2018-15891
FR
Freepbx
Freepbx
4.8
1%
Jun 20An issue was discovered in FreePBX core before 3.0.122.43, 14.0.18.34, and 5.0.1beta4
CVE-2014-7235
FR
Freepbx
Freepbx
–
44%
Oct 7htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface (ARI) in FreePBX before 2.9.0.9, 2.10.x, and 2.11 before 2.11.1.5 allows remote attackers to…
CVE-2014-1903
FR
Freepbx
Freepbx
–
52%
Feb 18admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha22 does not restrict the set of functions…
CVE-2009-4458
FR
Freepbx
Freepbx
–
2%
Dec 30Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.5.2 and 2.6.0rc2, and possibly other versions, allow remote attackers to inject arbitrary web script or HTML via…
CVE-2009-1803
FR
Freepbx
Freepbx
–
1%
May 28FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, generates different error messages for a failed login attempt depending on whether the user account exists,…
CVE-2009-1802
FR
Freepbx
Freepbx
–
1%
May 28Multiple cross-site request forgery (CSRF) vulnerabilities in FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, allow remote attackers to hijack the…
CVE-2009-1801
FR
Freepbx
Freepbx
–
1%
May 28Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, allow remote attackers to inject arbitrary web script…
CVE-2007-2350
FR
Freepbx
Freepbx
–
2%
Apr 30admin/config.php in the music-on-hold module in freePBX 2.2.x allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the del…
CVE-2007-2191
FR
Freepbx
Freepbx
–
4%
Apr 24Multiple cross-site scripting (XSS) vulnerabilities in freePBX 2.2.x allow remote attackers to inject arbitrary web script or HTML via the (1) From, (2) To, (3) Call-ID, (4)…