FreePBX · weakness class
SQL Injection
10 CVEs · 1 exploited
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
- exploited in the wild
- 1
- likely to be exploited
- 1
Every one of the 10 is a mark on the map. Named now: 1 to 10, most at risk first.
- FreePBX - Remote Code Execution
- FreePBX Endpoint Manager vulnerable to authenticated SQL injection in multiple configuration parameters
- Authenticated SQL Injection in FreePBX tts (Text To Speech) module
- FreePBX cdr Cdr.class.php ajaxHandler sql injection
- FreePBX 13 and 14 has SQL Injection in the DISA module via the hangup variable on the /admin/config.php?display=disa&view=form page.
- FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover
- FreePBX: Authenticated SQL Injection in CDR (Call Data Record) Reports
- FreePBX: Authenticated SQL Injection via ORDER BY in CDR Reports
- FreePBX: Authenticated SQL Injection Vulnerabilities in FreePBX Logfiles Module
- Authenticated SQL Injection in Endpoint Module Rest API
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data. Use this via MCP