SQL injection in FreePBX - CVE-2025-57819
Published: August 29, 2025 / Updated: June 23, 2026
Vulnerability identifier: #VU114554
CSH Severity: Critical
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-57819
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to insufficient sanitization of user-supplied data within the endpoint module. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands, leading to system compromise.
Note, the vulnerability is being actively exploited in the wild since August 21, 2025.
Affected software
FreePBX
How to mitigate CVE-2025-57819
Install updates from vendor's website.
FreePBX - addressed in versions 15.0.66, 16.0.89, 17.0.3
Links to Public Exploits and PoC-codes
- Exploit #12774 - CVE-2025-57819-poc (June 23, 2026)
- Exploit #12050 - watchTowr-vs-FreePBX-CVE-2025-57819 (October 31, 2025)
- Exploit #11986 - CVE-2025-57819 (September 24, 2025)
- Exploit #11978 - FreePBX ajax.php unuthenticated SQLi to RCE (September 23, 2025)
- Exploit #11974 - CVE-2025-57819_FreePBX (This repository contains a Proof of Concept (PoC) exploit for CVE-2025-57819, a critical remote code execution vulnerability affecting FreePBX versions 15.x, 16.x, and 17.x.) (September 19, 2025)
- Exploit #11930 - CVE-2025-57819 (September 5, 2025)