Product by Sangoma

    Sangoma FreePBX

    50 known vulnerabilities in Sangoma FreePBX (Sangoma), 2 of them actively exploited (CISA KEV).

    Key figures

    50

    Vulnerabilities

    2

    Actively exploited (KEV)

    0

    Used by ransomware

    7

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Sangoma FreePBX (Sangoma)
    CriticalCVE-2025-57819

    FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

    In CISA KEValso in 1 other product

    		9.8
    CriticalCVE-2019-19006

    Sangoma FreePBX Improper Authentication Vulnerability

    In CISA KEV

    		9.8
    HighCVE-2026-28287

    FreePBX: Authenticated Remote Code Execution via Recordings Module AJAX Endpoints

    also in 1 other product

    		8.8
    HighCVE-2025-67736

    Authenticated SQL Injection in FreePBX tts (Text To Speech) module

    also in 1 other product

    		7.2
    CriticalCVE-2025-66039

    FreePBX Framework: Improper Authentication

    also in 1 other product

    		9.8
    HighCVE-2024-58294

    FreePBX 16 Authenticated Remote Code Execution via API Module

    also in 1 other product

    		8.8
    HighCVE-2026-44237

    FreePBX: Authenticated Access can lead to Subsequent OAuth2 Authentication Bypass in API Module

    also in 1 other product

    		8.1
    HighCVE-2026-54674

    Authenticated Command Injection in FreePBX UCP Interface

    also in 1 other product

    		8.8
    HighCVE-2026-75600

    FreePBX: Authenticated API generatedocs Host Command Injection

    also in 1 other product

    		8.8
    HighCVE-2019-19538

    Sangoma FreePBX: Privilege Escalation

    		7.2
    HighCVE-2026-54675

    FreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang Module

    also in 1 other product

    		8.8
    HighCVE-2018-6393

    Sangoma FreePBX: SQL Injection

    		7.2
    HighCVE-2026-54708

    Authenticated Remote Code Execution via Path Traversal in FreePBX Backup Module

    also in 1 other product

    		8.8
    HighCVE-2026-54710

    FreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion)

    also in 1 other product

    		8.8
    HighCVE-2026-73662

    Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files

    also in 1 other product

    		7.2
    HighCVE-2026-28209

    FreePBX Security-reporting: OS Command Injection

    also in 1 other product

    		7.2
    CriticalCVE-2026-73663

    FreePBX Missedcall: SQL Injection

    also in 1 other product

    		9.8
    Not ratedCVE-2012-4869

    Sangoma FreePBX: security vulnerability

    		—
    Not ratedCVE-2014-1903

    FreePBX: security vulnerability

    also in 1 other product

    		—
    Not ratedCVE-2014-7235

    FreePBX: Code Execution

    also in 1 other product

    		—
    CriticalCVE-2026-46376

    FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface

    also in 1 other product

    		9.8
    CriticalCVE-2026-73665

    FreePBX Ucp: Missing Authorization

    also in 1 other product

    		9.8
    HighCVE-2026-45562

    FreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module

    also in 1 other product

    		7.2
    Not ratedCVE-2010-3490

    Sangoma FreePBX: Path Traversal

    		—
    HighCVE-2023-43336

    Sangoma FreePBX: security vulnerability

    		8.8

    All vulnerabilities in search

    All products by Sangoma