# cve.now: Freepbx

The newest entries naming Freepbx as an affected vendor (up to 200), of 44 in all, 2 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-75600](https://cve.now/CVE-2026-75600.md): FreePBX: Authenticated API generatedocs Host Command Injection (CVSS 8.6)
- [CVE-2026-54710](https://cve.now/CVE-2026-54710.md): FreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion) (CVSS 8.6)
- [CVE-2026-54708](https://cve.now/CVE-2026-54708.md): Authenticated Remote Code Execution via Path Traversal in FreePBX Backup Module (CVSS 8.6)
- [CVE-2026-54675](https://cve.now/CVE-2026-54675.md): FreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang Module (CVSS 8.7)
- [CVE-2026-54674](https://cve.now/CVE-2026-54674.md): Authenticated Command Injection in FreePBX UCP Interface (CVSS 8.6)
- [CVE-2026-45562](https://cve.now/CVE-2026-45562.md): FreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module (CVSS 7.7)
- [CVE-2026-73665](https://cve.now/CVE-2026-73665.md): FreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injection (CVSS 9.3)
- [CVE-2026-73664](https://cve.now/CVE-2026-73664.md): FreePBX: Authenticated Arbitrary SSH Key Injection via Backup Module (CVSS 8.6)
- [CVE-2026-73663](https://cve.now/CVE-2026-73663.md): FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover (CVSS 9.3)
- [CVE-2026-73662](https://cve.now/CVE-2026-73662.md): Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files (CVSS 7.6)
- [CVE-2026-73661](https://cve.now/CVE-2026-73661.md): FreePBX: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted Backup (CVSS 8.6)
- [CVE-2026-73660](https://cve.now/CVE-2026-73660.md): FreePBX: Authenticated TTS AGI Command Injection Through TTS Name (CVSS 7.5)
- [CVE-2026-72578](https://cve.now/CVE-2026-72578.md): FreePBX Framework - Missing CSRF Protection in Admin Panel Ajax Dispatcher (CVSS 8.8)
- [CVE-2026-44237](https://cve.now/CVE-2026-44237.md): FreePBX: Authenticated Access can lead to Subsequent OAuth2 Authentication Bypass in API Module (CVSS 7.6)
- [CVE-2026-44238](https://cve.now/CVE-2026-44238.md): FreePBX: Authenticated SQL Injection via ORDER BY in CDR Reports (CVSS 8.5)
- [CVE-2026-44239](https://cve.now/CVE-2026-44239.md): FreePBX: Authenticated Local File Inclusion in Dashboard Module (CVSS 7.6)
- [CVE-2026-46376](https://cve.now/CVE-2026-46376.md): FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface (CVSS 9.3)
- [CVE-2026-26978](https://cve.now/CVE-2026-26978.md): Free PBX backup: Deserialization of Untrusted Data in admin/modules/backup/Models/BackupSplFileInfo.php (CVSS 8.6)
- [CVE-2026-40520](https://cve.now/CVE-2026-40520.md): FreePBX api module Command Injection via GraphQL (CVSS 8.6)
- [CVE-2026-28287](https://cve.now/CVE-2026-28287.md): FreePBX: Authenticated Remote Code Execution via Recordings Module AJAX Endpoints (CVSS 8.6)
- [CVE-2026-28284](https://cve.now/CVE-2026-28284.md): FreePBX: Authenticated SQL Injection Vulnerabilities in FreePBX Logfiles Module (CVSS 8.6)
- [CVE-2026-28210](https://cve.now/CVE-2026-28210.md): FreePBX: Authenticated SQL Injection in CDR (Call Data Record) Reports (CVSS 8.6)
- [CVE-2026-28209](https://cve.now/CVE-2026-28209.md): FreePBX: Command Injection leading to Remote Code Execution in FreePBX ElevenLabs Text-to-Speech integration (CVSS 7.5)
- [CVE-2025-55210](https://cve.now/CVE-2025-55210.md): FreePBX API has a Privilege Escalation Error in GraphQL Allowing Authenticated Users to Access Additional Scopes (CVSS 2.0)
- [CVE-2025-67736](https://cve.now/CVE-2025-67736.md): Authenticated SQL Injection in FreePBX tts (Text To Speech) module (CVSS 8.6)
- [CVE-2025-67722](https://cve.now/CVE-2025-67722.md): Authenticated amportal search for ‘freepbx\_engine’ in non root writeable directories leads to potential privilege escalation (CVSS 5.7)
- [CVE-2024-58294](https://cve.now/CVE-2024-58294.md): FreePBX 16 Authenticated Remote Code Execution via API Module (CVSS 8.7)
- [CVE-2025-67513](https://cve.now/CVE-2025-67513.md): FreePBX Endpoint Manager's Weak Default Password Allows Unauthenticated Access in Endpoint Module REST API (CVSS 6.9)
- [CVE-2025-66039](https://cve.now/CVE-2025-66039.md): FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header (CVSS 9.3)
- [CVE-2025-62173](https://cve.now/CVE-2025-62173.md): Authenticated SQL Injection in Endpoint Module Rest API (CVSS 8.6)
- [CVE-2025-64328](https://cve.now/CVE-2025-64328.md): FreePBX Administration GUI is Vulnerable to Authenticated Command Injection (CVSS 8.6, KEV)
- [CVE-2025-61678](https://cve.now/CVE-2025-61678.md): FreePBX Endpoint Manager vulnerable to authenticated arbitrary file upload via fwbrand parameter (CVSS 8.6)
- [CVE-2025-61675](https://cve.now/CVE-2025-61675.md): FreePBX Endpoint Manager vulnerable to authenticated SQL injection in multiple configuration parameters (CVSS 8.6)
- [CVE-2025-59429](https://cve.now/CVE-2025-59429.md): FreePBX core module vulnerable to reflected cross-site scripting via Asterisk HTTP Status page (CVSS 8.5)
- [CVE-2025-59051](https://cve.now/CVE-2025-59051.md): FreePBX Endpoint Manager command injection via Network Scanning feature (CVSS 8.6)
- [CVE-2025-59056](https://cve.now/CVE-2025-59056.md): FreePBX vulnerable to unauthenticated Denial of Service (CVSS 6.6)
- [CVE-2025-55211](https://cve.now/CVE-2025-55211.md): FreePBX Post-Authenticated Command Injection (CVSS 6.3)
- [CVE-2025-55739](https://cve.now/CVE-2025-55739.md): api: Shared OAuth Signing Key Between Different Instances (CVSS 5.1)
- [CVE-2025-55209](https://cve.now/CVE-2025-55209.md): FreePBX UCP is Vulnerable to Stored XSS Through its User Control Panel (CVSS 5.1)
- [CVE-2025-57819](https://cve.now/CVE-2025-57819.md): FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE (CVSS 10.0, KEV)
- [CVE-2024-47071](https://cve.now/CVE-2024-47071.md): OSS Endpoint Manager allows unauthorized access to read system files (CVSS 6.8)
- [CVE-2019-25090](https://cve.now/CVE-2019-25090.md): FreePBX arimanager Views cross site scripting (CVSS 3.5)
- [CVE-2021-4282](https://cve.now/CVE-2021-4282.md): FreePBX voicemail page.voicemail.php cross site scripting (CVSS 3.5)
- [CVE-2020-36630](https://cve.now/CVE-2020-36630.md): FreePBX cdr Cdr.class.php ajaxHandler sql injection (CVSS 5.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/freepbx
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.