FreePBX
Sangoma- Software type
- —
- Catalog vulnerabilities
- 41
Severity across 1 analyzed records
Verify to analyze this security profile
A short verification protects source data and prevents automated AI requests.
en
Severity across 1 analyzed records
A short verification protects source data and prevents automated AI requests.
As of 09/11/2026, within CyStack's analyzed data, FreePBX has 0 security vulnerabilities published in the last 90 days. Of these, 0 are rated High or Critical. None of these vulnerabilities is listed in the CISA KEV catalog. CyStack recommends that organizations and individual users remediate applicable vulnerabilities as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of FreePBX and determine which vulnerabilities affect that version.
| CVE | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-44237FreePBX: Authenticated Access can lead to Subsequent OAuth2 Authentication Bypass in API Module | Exploitation statusNot known exploited | FixYes | Published05/29/2026 | SeverityHigh |
CVE-2026-44238FreePBX: Authenticated SQL Injection via ORDER BY in CDR Reports | Exploitation statusNot known exploited | FixYes | Published05/29/2026 | SeverityHigh |
CVE-2026-44239FreePBX: Authenticated Local File Inclusion in Dashboard Module | Exploitation statusNot known exploited | FixYes | Published05/29/2026 | SeverityHigh |
CVE-2026-46376FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface | Exploitation statusNot known exploited | FixYes | Published05/29/2026 | SeverityCritical |
CVE-2026-28287FreePBX: Authenticated Remote Code Execution via Recordings Module AJAX Endpoints | Exploitation statusNot known exploited | FixYes | Published03/05/2026 | SeverityHigh |
CVE-2026-28284FreePBX: Authenticated SQL Injection Vulnerabilities in FreePBX Logfiles Module | Exploitation statusNot known exploited | FixYes | Published03/05/2026 | SeverityHigh |
CVE-2026-28210FreePBX: Authenticated SQL Injection in CDR (Call Data Record) Reports | Exploitation statusNot known exploited | FixYes | Published03/05/2026 | SeverityHigh |
CVE-2026-28209FreePBX: Command Injection leading to Remote Code Execution in FreePBX ElevenLabs Text-to-Speech integration | Exploitation statusNot known exploited | FixYes | Published03/05/2026 | SeverityHigh |
CVE-2025-55210FreePBX API has a Privilege Escalation Error in GraphQL Allowing Authenticated Users to Access Additional Scopes | Exploitation statusNot known exploited | FixYes | Published02/12/2026 | SeverityLow |
CVE-2025-67736Authenticated SQL Injection in FreePBX tts (Text To Speech) module | Exploitation statusNot known exploited | FixNot confirmed | Published12/16/2025 | SeverityHigh |
CVE-2025-67722Authenticated amportal search for ‘freepbx_engine’ in non root writeable directories leads to potential privilege escalation | Exploitation statusNot known exploited | FixNot confirmed | Published12/16/2025 | SeverityMedium |
CVE-2024-58294FreePBX 16 Authenticated Remote Code Execution via API Module | Exploitation statusPublic exploit | FixNot confirmed | Published12/11/2025 | SeverityHigh |
CVE-2025-66039FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header | Exploitation statusNot known exploited | FixYes | Published12/09/2025 | SeverityCritical |
CVE-2025-64328FreePBX Administration GUI is Vulnerable to Authenticated Command Injection | Exploitation statusKEV | FixYes | Published11/07/2025 | SeverityHigh |
CVE-2025-59429FreePBX core module vulnerable to reflected cross-site scripting via Asterisk HTTP Status page | Exploitation statusPublic exploit | FixYes | Published10/14/2025 | SeverityHigh |
CVE-2025-59056FreePBX vulnerable to unauthenticated Denial of Service | Exploitation statusNot known exploited | FixYes | Published09/15/2025 | SeverityMedium |
CVE-2025-55211FreePBX Post-Authenticated Command Injection | Exploitation statusNot known exploited | FixYes | Published09/15/2025 | SeverityMedium |
CVE-2025-57819FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE | Exploitation statusKEV | FixYes | Published08/28/2025 | SeverityCritical |
CVE-2024-53564CVE-2024-53564 | Exploitation statusNot known exploited | FixNot confirmed | Published12/02/2024 | SeverityLow |
CVE-2023-43336CVE-2023-43336 | Exploitation statusPublic exploit | FixNot confirmed | Published11/02/2023 | SeverityUnknown |
CVE-2019-25090FreePBX arimanager Views cross site scripting | Exploitation statusNot confirmed | FixYes | Published12/27/2022 | SeverityLow |
CVE-2020-36630FreePBX cdr Cdr.class.php ajaxHandler sql injection | Exploitation statusNot confirmed | FixYes | Published12/25/2022 | SeverityMedium |
CVE-2019-19852CVE-2019-19852 | Exploitation statusNot confirmed | FixNot confirmed | Published03/16/2020 | SeverityUnknown |
CVE-2019-19615CVE-2019-19615 | Exploitation statusNot confirmed | FixNot confirmed | Published03/16/2020 | SeverityUnknown |
CVE-2019-19538CVE-2019-19538 | Exploitation statusNot confirmed | FixNot confirmed | Published03/16/2020 | SeverityUnknown |
CVE-2019-19851CVE-2019-19851 | Exploitation statusNot confirmed | FixNot confirmed | Published03/16/2020 | SeverityUnknown |
CVE-2019-19551CVE-2019-19551 | Exploitation statusNot confirmed | FixNot confirmed | Published12/06/2019 | SeverityUnknown |
CVE-2019-19552CVE-2019-19552 | Exploitation statusNot confirmed | FixNot confirmed | Published12/06/2019 | SeverityUnknown |
CVE-2019-19006CVE-2019-19006 | Exploitation statusKEV | FixNot confirmed | Published11/21/2019 | SeverityCritical |
CVE-2019-16967CVE-2019-16967 | Exploitation statusNot confirmed | FixNot confirmed | Published10/21/2019 | SeverityUnknown |
CVE-2019-16966CVE-2019-16966 | Exploitation statusNot confirmed | FixNot confirmed | Published10/21/2019 | SeverityUnknown |
CVE-2018-15891CVE-2018-15891 | Exploitation statusNot confirmed | FixNot confirmed | Published06/20/2019 | SeverityUnknown |
CVE-2018-6393CVE-2018-6393 | Exploitation statusNot confirmed | FixNot confirmed | Published01/29/2018 | SeverityUnknown |
CVE-2014-7235CVE-2014-7235 | Exploitation statusPublic exploit | FixNot confirmed | Published10/07/2014 | SeverityUnknown |
CVE-2014-1903CVE-2014-1903 | Exploitation statusNot confirmed | FixNot confirmed | Published02/18/2014 | SeverityUnknown |
CVE-2012-4869CVE-2012-4869 | Exploitation statusPublic exploit | FixNot confirmed | Published09/06/2012 | SeverityUnknown |
CVE-2012-4870CVE-2012-4870 | Exploitation statusPublic exploit | FixNot confirmed | Published09/06/2012 | SeverityUnknown |
CVE-2010-3490CVE-2010-3490 | Exploitation statusPublic exploit | FixNot confirmed | Published09/28/2010 | SeverityUnknown |
CVE-2009-1802CVE-2009-1802 | Exploitation statusNot confirmed | FixNot confirmed | Published05/28/2009 | SeverityUnknown |
CVE-2009-1803CVE-2009-1803 | Exploitation statusNot confirmed | FixNot confirmed | Published05/28/2009 | SeverityUnknown |
CVE-2009-1801CVE-2009-1801 | Exploitation statusNot confirmed | FixNot confirmed | Published05/28/2009 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan