Vulnerabilidades em FreePBX
44 resultadosAnálise Vexday
FreePBX apresenta 31 vulnerabilidades catalogadas, com 2 sob exploração ativa e 3 críticas, indicando risco moderado com ataques reais em curso. A fraqueza dominante é injeção SQL (CWE-89), típica de aplicações web legadas, e o descobrimento recente de 5 vulnerabilidades nos últimos 90 dias sugere superfície de ataque ainda em evolução. Priorize patching das falhas críticas e daquelas em KEV, com atenção especial aos inputs de banco de dados.
CVE-2025-59051HIGHFreePBX Endpoint Manager command injection via Network Scanning featureEPSS 0.5%CVE-2026-54708HIGHAuthenticated Remote Code Execution via Path Traversal in FreePBX Backup ModuleEPSS 0.5%CVE-2026-54710HIGHFreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion)EPSS 0.5%CVE-2024-47071MEDIUMOSS Endpoint Manager allows unauthorized access to read system filesEPSS 0.5%CVE-2026-73664HIGHFreePBX: Authenticated Arbitrary SSH Key Injection via Backup ModuleEPSS 0.5%CVE-2025-59056MEDIUMFreePBX vulnerable to unauthenticated Denial of ServiceEPSS 0.5%CVE-2025-55211MEDIUMFreePBX Post-Authenticated Command InjectionEPSS 0.4%CVE-2026-46376CRITICALFreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP InterfaceEPSS 0.4%CVE-2025-55739MEDIUMapi: Shared OAuth Signing Key Between Different InstancesEPSS 0.4%CVE-2026-73663CRITICALFreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeoverEPSS 0.4%CVE-2026-45562HIGHFreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) ModuleEPSS 0.4%CVE-2025-55209MEDIUMFreePBX UCP is Vulnerable to Stored XSS Through its User Control PanelEPSS 0.4%CVE-2026-28210HIGHFreePBX: Authenticated SQL Injection in CDR (Call Data Record) ReportsEPSS 0.3%CVE-2025-55210LOWFreePBX API has a Privilege Escalation Error in GraphQL Allowing Authenticated Users to Access Additional ScopesEPSS 0.3%CVE-2026-73665CRITICALFreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injectionEPSS 0.3%CVE-2026-73661HIGHFreePBX: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted BackupEPSS 0.3%CVE-2026-44238HIGHFreePBX: Authenticated SQL Injection via ORDER BY in CDR ReportsEPSS 0.3%CVE-2026-28284HIGHFreePBX: Authenticated SQL Injection Vulnerabilities in FreePBX Logfiles ModuleEPSS 0.3%CVE-2025-62173HIGHAuthenticated SQL Injection in Endpoint Module Rest APIEPSS 0.3%CVE-2026-44239HIGHFreePBX: Authenticated Local File Inclusion in Dashboard ModuleEPSS 0.3%