Freepbx vulnerabilities
44 CVEs and advisories name Freepbx as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-64328FreePBX Administration GUI is Vulnerable to Authenticated Command Injection
- CVE-2025-61678FreePBX Endpoint Manager vulnerable to authenticated arbitrary file upload via fwbrand parameter
- CVE-2025-61675FreePBX Endpoint Manager vulnerable to authenticated SQL injection in multiple configuration parameters
- CVE-2025-59429FreePBX core module vulnerable to reflected cross-site scripting via Asterisk HTTP Status page
- CVE-2025-59051FreePBX Endpoint Manager command injection via Network Scanning feature
- CVE-2025-59056FreePBX vulnerable to unauthenticated Denial of Service
- CVE-2025-55211FreePBX Post-Authenticated Command Injection
- CVE-2025-55739api: Shared OAuth Signing Key Between Different Instances
- CVE-2025-55209FreePBX UCP is Vulnerable to Stored XSS Through its User Control Panel
- CVE-2025-57819FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
- CVE-2024-47071OSS Endpoint Manager allows unauthorized access to read system files
- CVE-2019-25090FreePBX arimanager Views cross site scripting
- CVE-2021-4282FreePBX voicemail page.voicemail.php cross site scripting
- CVE-2020-36630FreePBX cdr Cdr.class.php ajaxHandler sql injection