CVE-2026-44238: high-severity vulnerability in FreePBX security-reporting
FreePBX: Authenticated SQL Injection via ORDER BY in CDR Reports
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.5epss 0.3%
FreePBX is an open source IP PBX. Prior to 16.0.50 and 17.0.11, the CDR Reports module page allows SQL injection through the order and sort POST parameters. Authentication with a FreePBX Administration Control Panel account that has CDR section access is required. Full administrator privileges are not needed. This vulnerability is fixed in 16.0.50 and 17.0.11.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
FreePBX · security-reportingRelated CVEs — FreePBX security-reporting
In the same product, most dangerous first.
CVE-2026-28287HIGHFreePBX: Authenticated Remote Code Execution via Recordings Module AJAX EndpointsEPSS 9.3%CVE-2026-44237HIGHFreePBX: Authenticated Access can lead to Subsequent OAuth2 Authentication Bypass in API ModuleEPSS 2.7%CVE-2026-28209HIGHFreePBX: Command Injection leading to Remote Code Execution in FreePBX ElevenLabs Text-to-Speech integrationEPSS 1.0%CVE-2026-26978HIGHFree PBX backup: Deserialization of Untrusted Data in admin/modules/backup/Models/BackupSplFileInfo.phpEPSS 0.9%CVE-2026-54674HIGHAuthenticated Command Injection in FreePBX UCP InterfaceEPSS 0.9%CVE-2026-75600HIGHFreePBX: Authenticated API generatedocs Host Command InjectionEPSS 0.8%