CVE-2025-57819Critical· 9.8▾ Hadal⚠ Exploited in the wild0dayPoC availableFreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrar…
▾ Hadal zone — Critical and actively exploited (CISA KEV / 0day)
impact 53.9 · likelihood 19 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 4 sources. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Sep 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Federal remediation due Sep 19, 2025
Last analysed / modified upstream
85%
Exploit-DB · 25 GitHub repos · Metasploit ×1 · Nuclei ×1 (last check)
85% → 95%
Added to the CISA catalog on Aug 29, 2025. Federal remediation due Sep 19, 2025. View catalog ↗
FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.
freepbx >= 15.0, < 15.0.66freepbx >= 16.0, < 16.0.89freepbx >= 17.0, < 17.0.3Upgrade past the affected range:
freepbx 17.0.3Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-9586Critical· 9.8An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into …
CVE-2025-67736High· 7.2The FreePBX module tts (Text to Speech) for FreePBX, an open-source web-based graphical user interface (GUI) that manages Asterisk
CVE-2026-73663Critical· 9.8FreePBX is an open source IP PBX
CVE-2017-18362Critical· 9.8ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database
CVE-2025-66039Critical· 9.8FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems
CVE-2025-59429Medium· 5.4FreePBX is an open source GUI for managing Asterisk