Skip to content
Noroxi

FreePBX records

14 published records for vendor freepbx.

Researcher profile

Entered KEV
0 · 0%
Weaponized
1 · 7.1%
Pre-auth RCE
2
With a fix record
7.1%
Median publish → KEV
No record has entered KEV

Records by year

  1. 19
  2. 24
  3. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

14 records
  • CVE-2014-7235
    53Plan

    htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface (ARI) in FreePBX before 2.9.0.9, 2.10.x, and 2.11 bef

    CriticalCVSS 10.0Proof of conceptEPSS 43%

    freepbx · freepbxOct 7, 2014

  • CVE-2014-1903
    46Plan

    admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha22

    HighCVSS 7.5WeaponizedEPSS 51%

    freepbx · freepbxFeb 18, 2014

  • CVE-2026-40520
    34Monitor

    FreePBX api module Command Injection via GraphQL

    HighCVSS 8.6No exploitEPSS 1%

    freepbx · apiApr 21, 2026

  • CVE-2007-2191
    28Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in freePBX 2.2.x allow remote attackers to inject arbitrary web script or HTML via the (

    MediumCVSS 6.8Proof of conceptEPSS 4%

    freepbx · freepbxApr 24, 2007

  • CVE-2007-2350
    27Monitor

    admin/config.php in the music-on-hold module in freePBX 2.2.x allows remote authenticated administrators to execute arbitrary commands via s

    MediumCVSS 6.5No exploitEPSS 2%

    freepbx · freepbxApr 30, 2007

  • CVE-2009-1802
    27Monitor

    Multiple cross-site request forgery (CSRF) vulnerabilities in FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, allow r

    MediumCVSS 6.8No exploitEPSS 0%

    freepbx · freepbxMay 28, 2009

  • CVE-2024-47071
    27Monitor

    OSS Endpoint Manager allows unauthorized access to read system files

    MediumCVSS 6.8No exploitEPSS 0%

    freepbx · endpointmanOct 1, 2024

  • CVE-2019-16967
    24Monitor

    An issue was discovered in Manager 13.x before 13.0.2.6 and 15.x before 15.0.6 before FreePBX 14.0.10.3.

    MediumCVSS 6.1No exploitEPSS 1%

    freepbx · managerOct 21, 2019

  • CVE-2019-16966
    24Monitor

    An issue was discovered in Contactmanager 13.x before 13.0.45.3, 14.x before 14.0.5.12, and 15.x before 15.0.8.21 for FreePBX 14.0.10.3.

    MediumCVSS 6.1No exploitEPSS 1%

    freepbx · contactmanagerOct 21, 2019

  • CVE-2009-1803
    20Monitor

    FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, generates different error messages for a failed login attempt dependi

    MediumCVSS 5.0No exploitEPSS 1%

    freepbx · freepbxMay 28, 2009

  • CVE-2018-15891
    19Monitor

    An issue was discovered in FreePBX core before 3.0.122.43, 14.0.18.34, and 5.0.1beta4.

    MediumCVSS 4.8No exploitEPSS 0%

    freepbx · freepbxJun 20, 2019

  • CVE-2009-4458
    18Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.5.2 and 2.6.0rc2, and possibly other versions, allow remote attackers to in

    MediumCVSS 4.3Proof of conceptEPSS 1%

    freepbx · freepbxDec 29, 2009

  • CVE-2009-1801
    17Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, allow remote a

    MediumCVSS 4.3No exploitEPSS 1%

    freepbx · freepbxMay 28, 2009

  • CVE-2018-15892
    17Monitor

    FreePBX 13 and 14 has SQL Injection in the DISA module via the hangup variable on the /admin/config.php?display=disa&view=form page.

    MediumCVSS 4.3No exploitEPSS 0%

    freepbx · disaJun 20, 2019