Advisories · Technology
FreePBX security-reporting.
Every CVE that names FreePBX security-reporting among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.6 High
FreePBX: Authenticated API generatedocs Host Command Injection
- FreePBX security-reporting
- Command injection
- CVSS 8.6 High
FreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion)
- FreePBX security-reporting
- Code injection
- CWE-20
- CVSS 8.6 High
Authenticated Remote Code Execution via Path Traversal in FreePBX Backup Module
- FreePBX security-reporting
- Path traversal
- Code injection
- CVSS 8.7 High
FreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang Module
- FreePBX security-reporting
- Path traversal
- Unrestricted file upload
- CVSS 8.6 High
Authenticated Command Injection in FreePBX UCP Interface
- FreePBX security-reporting
- Command injection
- CVSS 7.7 High
FreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module
- FreePBX security-reporting
- Command injection
- CVSS 7.6 High
FreePBX: Authenticated Access can lead to Subsequent OAuth2 Authentication Bypass in API Module
- FreePBX security-reporting
- Authentication bypass
- CVSS 8.5 High
FreePBX: Authenticated SQL Injection via ORDER BY in CDR Reports
- FreePBX security-reporting
- SQL injection
- CVSS 7.6 High
FreePBX: Authenticated Local File Inclusion in Dashboard Module
- FreePBX security-reporting
- File inclusion
- CVSS 9.3 CriticalCritical · CVSS 9+
FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface
- FreePBX security-reporting
- Hard-coded credentials
- CVSS 8.6 High
Free PBX backup: Deserialization of Untrusted Data in admin/modules/backup/Models/BackupSplFileInfo.php
- FreePBX security-reporting
- Insecure deserialization
- CVSS 8.6 High
FreePBX: Authenticated Remote Code Execution via Recordings Module AJAX Endpoints
- FreePBX security-reporting
- Command injection
- CVSS 8.6 High
FreePBX: Authenticated SQL Injection Vulnerabilities in FreePBX Logfiles Module
- FreePBX security-reporting
- SQL injection
- CVSS 8.6 High
FreePBX: Authenticated SQL Injection in CDR (Call Data Record) Reports
- FreePBX security-reporting
- SQL injection
- CVSS 7.5 High
FreePBX: Command Injection leading to Remote Code Execution in FreePBX ElevenLabs Text-to-Speech integration
- FreePBX security-reporting
- Command injection