Sangoma Freepbx
42 CVEs affecting Sangoma Freepbx. Latest disclosed: 2026-05-29. Critical: 6, High: 16.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-46376 | Critical | 9.8 | 2026-05-29 | FreePBX is an open source IP PBX. From 15.0.42 to before 16.0.45 and 17.0.7, unauthenticated users may be able to access the User Control Panel (UCP) using har… |
CVE-2025-66039 | Critical | 9.8 | 2025-12-09 | FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions are vulnerable to authentication bypass when the authenticat… |
CVE-2025-57819 | Critical | 9.8 | 2025-08-28 | FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied dat… |
CVE-2021-45461 | Critical | 9.8 | 2021-12-22 | FreePBX, when restapps (aka Rest Phone Apps) 15.0.19.87, 15.0.19.88, 16.0.18.40, or 16.0.18.41 is installed, allows remote attackers to execute arbitrary code… |
CVE-2020-10666 | Critical | 9.8 | 2021-05-31 | The restapps (aka Rest Phone apps) module for Sangoma FreePBX and PBXact 13, 14, and 15 through 15.0.19.2 allows remote code execution via a URL variable to an… |
CVE-2019-19006 | Critical | 9.8 | 2019-11-21 | Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control. |
CVE-2026-44239 | High | 8.8 | 2026-05-29 | FreePBX is an open source IP PBX. Prior to 16.0.22 and 17.0.5, the Dashboard module's getcontent AJAX handler includes PHP files based on user-supplied input w… |
CVE-2026-44238 | High | 8.8 | 2026-05-29 | FreePBX is an open source IP PBX. Prior to 16.0.50 and 17.0.11, the CDR Reports module page allows SQL injection through the order and sort POST parameters. Au… |
CVE-2026-28287 | High | 8.8 | 2026-03-05 | FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, multiple command injection vulnerabilit… |
CVE-2026-28284 | High | 8.8 | 2026-03-05 | FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, the FreePBX logfiles module contains several authenticated SQL injection vulnerabilitie… |
CVE-2026-28210 | High | 8.8 | 2026-03-05 | FreePBX is an open source IP PBX. Prior to versions 16.0.49 and 17.0.7, FreePBX module cdr (Call Data Record) is vulnerable to SQL query injection. This issue… |
CVE-2024-58294 | High | 8.8 | 2025-12-11 | FreePBX 16 contains an authenticated remote code execution vulnerability in the API module that allows attackers with valid session credentials to execute arbi… |
CVE-2025-55211 | High | 8.8 | 2025-09-15 | FreePBX is an open-source web-based graphical user interface. From 17.0.19.11 to before 17.0.21, authenticated users of the Administrator Control Panel (ACP) c… |
CVE-2023-43336 | High | 8.8 | 2023-11-02 | Sangoma Technologies FreePBX before cdr 15.0.18, 16.0.40, 15.0.16, and 16.0.17 was discovered to contain an access control issue via a modified parameter value… |
CVE-2026-44237 | High | 8.1 | 2026-05-29 | FreePBX is an open source IP PBX. Prior to 17.0.8, the FreePBX api module's OAuth2 implementation does not sufficiently validate client credentials during toke… |
CVE-2025-67722 | High | 7.8 | 2025-12-16 | FreePBX is an open-source web-based graphical user interface (GUI) that manages Asterisk. Prior to versions 16.0.45 and 17.0.24 of the FreePBX framework, an au… |
CVE-2025-55210 | High | 7.5 | 2026-02-12 | FreePBX is an open-source web-based graphical user interface (GUI) that manages Asterisk. Prior to 17.0.5 and 16.0.17, FreePBX module api (PBX API) is vulnerab… |
CVE-2025-59056 | High | 7.5 | 2025-09-15 | FreePBX is an open-source web-based graphical user interface. In FreePBX 15, 16, and 17, malicious connections to the Administrator Control Panel web interface… |
CVE-2026-28209 | High | 7.2 | 2026-03-05 | FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, a command injection vulnerability exist… |
CVE-2025-67736 | High | 7.2 | 2025-12-16 | The FreePBX module tts (Text to Speech) for FreePBX, an open-source web-based graphical user interface (GUI) that manages Asterisk. Versions prior to 16.0.5 an… |