Mwtcmi Frogman
5 CVEs affecting Mwtcmi Frogman. Latest disclosed: 2026-07-20. Critical: 1, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-46512 | Critical | 9.9 | 2026-07-16 | Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_dialplan_apply accepted template parameters including greeting, dest, url, e… |
CVE-2026-46513 | High | 7.4 | 2026-07-16 | Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, Frogman stored API tokens generated by Tools/CreateApiToken.php:33-36 as raw bi… |
CVE-2026-46514 | Medium | 6.5 | 2026-07-16 | Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_reset_password in Tools/ResetPassword.php:48-53 returned a plaintext passwor… |
CVE-2026-46516 | | 2026-07-20 | Frogman provides headless FreePBX control. Prior to version 1.6.6, Frogman's chat-console markdown formatter (`assets/js/chat.js`'s `formatMarkdown`) inserted… | |
CVE-2026-46515 | | 2026-07-16 | Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.3, PERM_READ access was sufficient to call fm_list_managers, fm_list_pinsets, fm_s… |