Log in Start free

FreePBX

Products

ProductCVEsExploitedLatest
endpoint41Dec 10, 2025
filestore11Nov 7, 2025
security-reporting15–Sep 28, 2026
framework5–Aug 13, 2026
api3–Apr 21, 2026
tts2–Aug 13, 2026
endpointman2–Oct 14, 2025
missedcall1–Aug 13, 2026
music1–Aug 13, 2026
restapps1–Dec 3, 2025
ucp1–Aug 13, 2026
voicemail1–Dec 27, 2022
backup1–Aug 13, 2026
cdr1–Dec 25, 2022
contactmanager1–Sep 4, 2025
core1–Oct 14, 2025
FreePBX1–Dec 11, 2025
FreePBX Framework1–Aug 10, 2026

Exploited and recent CVEs

  • CVE-2025-64328 High 8.6 Exploited FreePBX Administration GUI is Vulnerable to Authenticated Command Injection 84.6%
  • CVE-2025-57819 Critical 10.0 Exploited FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE 95.2%
  • CVE-2026-75600 High 8.6 FreePBX: Authenticated API generatedocs Host Command Injection 0.8%
  • CVE-2026-54710 High 8.6 FreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion) 0.5%
  • CVE-2026-54708 High 8.6 Authenticated Remote Code Execution via Path Traversal in FreePBX Backup Module 0.5%
  • CVE-2026-54675 High 8.7 FreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang Module 0.7%
  • CVE-2026-54674 High 8.6 Authenticated Command Injection in FreePBX UCP Interface 0.9%
  • CVE-2026-45562 High 7.7 FreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module 0.4%
  • CVE-2026-73665 Critical 9.3 FreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injection 0.3%
  • CVE-2026-73664 High 8.6 FreePBX: Authenticated Arbitrary SSH Key Injection via Backup Module 0.5%
  • CVE-2026-73663 Critical 9.3 FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover 0.4%
  • CVE-2026-73662 High 7.6 Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files 0.9%
  • CVE-2026-73661 High 8.6 FreePBX: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted Backup 0.3%
  • CVE-2026-73660 High 7.5 FreePBX: Authenticated TTS AGI Command Injection Through TTS Name 0.8%
  • CVE-2026-72578 High 8.8 FreePBX Framework - Missing CSRF Protection in Admin Panel Ajax Dispatcher 0.3%
  • CVE-2026-44237 High 7.6 FreePBX: Authenticated Access can lead to Subsequent OAuth2 Authentication Bypass in API Module 2.7%
  • CVE-2026-44238 High 8.5 FreePBX: Authenticated SQL Injection via ORDER BY in CDR Reports 0.3%
  • CVE-2026-44239 High 7.6 FreePBX: Authenticated Local File Inclusion in Dashboard Module 0.3%
  • CVE-2026-46376 Critical 9.3 FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface 0.4%
  • CVE-2026-26978 High 8.6 Free PBX backup: Deserialization of Untrusted Data in admin/modules/backup/Models/BackupSplFileInfo.php 0.9%
  • CVE-2026-40520 High 7.2 FreePBX api module Command Injection via GraphQL 1.4%
  • CVE-2026-28287 High 8.6 FreePBX: Authenticated Remote Code Execution via Recordings Module AJAX Endpoints 9.3%
  • CVE-2026-28284 High 8.6 FreePBX: Authenticated SQL Injection Vulnerabilities in FreePBX Logfiles Module 0.3%
  • CVE-2026-28210 High 8.6 FreePBX: Authenticated SQL Injection in CDR (Call Data Record) Reports 0.3%
  • CVE-2026-28209 High 7.5 FreePBX: Command Injection leading to Remote Code Execution in FreePBX ElevenLabs Text-to-Speech integration 1.0%
  • CVE-2025-55210 Low 2.0 FreePBX API has a Privilege Escalation Error in GraphQL Allowing Authenticated Users to Access Additional Scopes 0.3%
  • CVE-2025-67736 High 8.6 Authenticated SQL Injection in FreePBX tts (Text To Speech) module 6.4%
  • CVE-2025-67722 Medium 5.7 Authenticated amportal search for ‘freepbx_engine’ in non root writeable directories leads to potential privilege escalation 0.1%
  • CVE-2024-58294 High 8.7 FreePBX 16 Authenticated Remote Code Execution via API Module 3.6%
  • CVE-2025-67513 Medium 6.9 FreePBX Endpoint Manager's Weak Default Password Allows Unauthenticated Access in Endpoint Module REST API 0.3%