Product by FreePBX
Security-reporting
15 known vulnerabilities in Security-reporting (FreePBX), 0 of them actively exploited (CISA KEV).
Key figures
15
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-28287 | FreePBX: Authenticated Remote Code Execution via Recordings Module AJAX Endpoints | 8.8 | |
| High | CVE-2026-44237 | FreePBX: Authenticated Access can lead to Subsequent OAuth2 Authentication Bypass in API Module | 8.1 | |
| High | CVE-2026-54674 | Authenticated Command Injection in FreePBX UCP Interface | 8.8 | |
| High | CVE-2026-75600 | FreePBX: Authenticated API generatedocs Host Command Injection | 8.8 | |
| High | CVE-2026-54675 | FreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang Module | 8.8 | |
| High | CVE-2026-54708 | Authenticated Remote Code Execution via Path Traversal in FreePBX Backup Module | 8.8 | |
| High | CVE-2026-54710 | FreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion) | 8.8 | |
| High | CVE-2026-26978 | FreePBX Security-reporting: Deserialization of Untrusted Data | — | |
| High | CVE-2026-28209 | FreePBX Security-reporting: OS Command Injection | 7.2 | |
| Critical | CVE-2026-46376 | FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface | 9.8 | |
| High | CVE-2026-45562 | FreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module | 7.2 | |
| High | CVE-2026-44238 | FreePBX: Authenticated SQL Injection via ORDER BY in CDR Reports | 8.8 | |
| High | CVE-2026-44239 | FreePBX: Authenticated Local File Inclusion in Dashboard Module | 8.8 | |
| High | CVE-2026-28210 | FreePBX: Authenticated SQL Injection in CDR (Call Data Record) Reports | 8.8 | |
| High | CVE-2026-28284 | FreePBX: Authenticated SQL Injection Vulnerabilities in FreePBX Logfiles Module | 8.8 |