Known vulnerabilities in FreePBX
Vendor:
FreePBX
Software:
FreePBX
Software CPE:
cpe:2.3:a:freepbx:freepbx:*:*:*:*:*:*:*:*
Website:
https://www.freepbx.org/
Total vulnerabilities:
6
Public exploits:
4
Known exploited (KEV):
2
Highest CVSSv4 Score:
9.3
Breakdown by Severity Chart
16.0
17.0.3
16.0.89
15.0.66
16.0.9
16.0.8
16.0.7
16.0.6
16.0.5
16.0.4
16.0.3
16.0.2
15.0.12
15.0.11
15.0.10
15.0.9
15.0.8
15.0.7
15.0.6
15.0.5
15.0.4
15.0.3
15.0.2
13.0.7.11
13.0.7.10
13.0.7.9
13.0.7.8
13.0.7.7
13.0.7.6
13.0.7.5
13.0.7.4
13.0.7.3
13.0.7.1
13.0.7
13.0.6
13.0.5.1
13.0.5
13.0.4
13.0.3
13.0.2
13.0.1
2.11.3.2
2.11.3.0
2.11.2.9
2.11.2.7
2.11.2.6
2.11.2.5
2.11.2.4
2.11.2.3
2.11.2.2
2.11.2.1
2.11.2.0
2.11.0.10
2.11.0.9
2.11.0.8
2.11.0.7
2.11.0.6
2.11.0.5
2.10.0.9.3
15.0.16.26
14.0.13.11
13.0.197.13
15.0.16.27
14.0.13.12
13.0.197.14
2.9
2.12
2.11
2.10
15.0.1
2.11.1.4
2.11.1.3
2.11.1.2
2.11.1.1
2.11.1.0
2.11.0.4
2.11.0.3
2.11.0.2
2.11.0.1
2.11.0.0
2.10.0.10
2.10.0.9
2.10.0.8
2.10.0.7
2.10.0.6
2.10.0.5
2.10.0.4
2.10.0.3
2.10.0.2
2.10.0.1
2.10.0.0
2.9.0.8
Vulnerabilities (6)
| Vulnerability | CWE-ID | CSH Severity | Public Exploit | KEV | First fixed release | Published | Bulletins |
|---|---|---|---|---|---|---|---|
| #VU114554 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CVE-2025-57819 |
CWE-89 | Critical | 15.0.66, 16.0.89, 17.0.3 | 29.08.2025 |
SB2025082906 |
||
| #VU48170 - Improper Authentication CVE-2019-19006 |
CWE-287 | High | 13.0.197.14, 14.0.13.12, 15.0.16.27 | 21.11.2019 |
SB2019112173 |
||
| #VU35789 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2018-15891 |
CWE-79 | Low | - | 20.06.2019 |
SB2019062011 |
||
| #VU5362 - Improper Control of Generation of Code ('Code Injection') CVE-2014-7235 |
CWE-94 | Critical | - | 24.01.2017 |
SB2014093001 |
||
| #VU42023 - Permissions, Privileges, and Access Controls CVE-2014-1903 |
CWE-264 | Medium | - | 18.02.2014 |
SB2014021802 |
||
| #VU43620 - Improper Control of Generation of Code ('Code Injection') CVE-2012-4869 |
CWE-94 | Medium | - | 06.09.2012 |
SB2012090603 |