Vendor

    FreePBX

    55 known vulnerabilities in products by FreePBX, 2 of them actively exploited (CISA KEV).

    Key figures

    55

    Vulnerabilities

    2

    Actively exploited (KEV)

    0

    Used by ransomware

    7

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in FreePBX
    CriticalCVE-2025-57819

    FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

    In CISA KEValso in 1 other product

    		9.8
    CriticalCVE-2025-64328

    FreePBX Administration GUI is Vulnerable to Authenticated Command Injection

    In CISA KEValso in 1 other product

    		7.2
    HighCVE-2025-61678

    FreePBX Endpoint Manager vulnerable to authenticated arbitrary file upload via fwbrand parameter

    		—
    HighCVE-2025-61675

    FreePBX Endpoint: SQL Injection

    		—
    HighCVE-2026-28287

    FreePBX: Authenticated Remote Code Execution via Recordings Module AJAX Endpoints

    also in 1 other product

    		8.8
    HighCVE-2025-67736

    Authenticated SQL Injection in FreePBX tts (Text To Speech) module

    also in 1 other product

    		7.2
    CriticalCVE-2025-66039

    FreePBX Framework: Improper Authentication

    also in 1 other product

    		9.8
    HighCVE-2024-58294

    FreePBX 16 Authenticated Remote Code Execution via API Module

    also in 1 other product

    		8.8
    HighCVE-2026-44237

    FreePBX: Authenticated Access can lead to Subsequent OAuth2 Authentication Bypass in API Module

    also in 1 other product

    		8.1
    HighCVE-2026-40520

    FreePBX api module Command Injection via GraphQL

    		8.8
    HighCVE-2026-54674

    Authenticated Command Injection in FreePBX UCP Interface

    also in 1 other product

    		8.8
    HighCVE-2026-75600

    FreePBX: Authenticated API generatedocs Host Command Injection

    also in 1 other product

    		8.8
    HighCVE-2026-54675

    FreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang Module

    also in 1 other product

    		8.8
    HighCVE-2026-54708

    Authenticated Remote Code Execution via Path Traversal in FreePBX Backup Module

    also in 1 other product

    		8.8
    HighCVE-2026-54710

    FreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion)

    also in 1 other product

    		8.8
    HighCVE-2026-73662

    Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files

    also in 1 other product

    		7.2
    HighCVE-2026-26978

    FreePBX Security-reporting: Deserialization of Untrusted Data

    		—
    HighCVE-2026-73660

    FreePBX: Authenticated TTS AGI Command Injection Through TTS Name

    		—
    HighCVE-2026-28209

    FreePBX Security-reporting: OS Command Injection

    also in 1 other product

    		7.2
    HighCVE-2026-73664

    FreePBX: Authenticated Arbitrary SSH Key Injection via Backup Module

    		—
    CriticalCVE-2026-73663

    FreePBX Missedcall: SQL Injection

    also in 1 other product

    		9.8
    Not ratedCVE-2014-1903

    FreePBX: security vulnerability

    also in 1 other product

    		—
    Not ratedCVE-2014-7235

    FreePBX: Code Execution

    also in 1 other product

    		—
    CriticalCVE-2026-46376

    FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface

    also in 1 other product

    		9.8
    CriticalCVE-2026-73665

    FreePBX Ucp: Missing Authorization

    also in 1 other product

    		9.8

    All vulnerabilities in search

    Products

    Products by FreePBX
    Security-reporting150
    FreePBX100
    Framework50
    Endpoint41
    API30