CVE Feed

    Dashboard / CVE / CVE-2025-57819

    CVE-2025-57819

    FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.

    Published:Aug 28, 2025
    Last Modified:Feb 26, 2026
    EPS:Aug 28, 2025
    EPSS Score:0.67428
    CVSS Score:9.8

    CISA Notification

    Description

    FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.

    Required Action:

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

    Notes:

    No extra notes provided.

    Due Date
    Sep 19, 2025
    357 days ago
    Alert Date
    Aug 29, 2025
    378 days ago

    Affected Products

    Vendor
    Freepbx
    Product
    Freepbx
    Vendor
    Sangoma
    Product
    Freepbx

    Exploits

    https://github.com/watchtowrlabs/watchTowr-vs-FreePBX-CVE-2025-57819https://www.exploit-db.com/exploits/52681https://github.com/0xEhab/FreePBX-CVE-2025-57819-RCEhttps://github.com/0xyngtg/FreePBX-CVE-2025-57819-CVE-2025-61678https://github.com/Ashwesker/Blackash-CVE-2025-57819https://github.com/B1ack4sh/Blackash-CVE-2025-57819https://github.com/b4sh2/CVE-2025-57819-pochttps://github.com/blueisbeautiful/CVE-2025-57819https://github.com/brokendreamsclub/CVE-2025-57819https://github.com/cybertechajju/cve-2025-57819https://github.com/DiegoRivas1/htb-labs-connectedhttps://github.com/ImBIOS/lab-cve-2025-57819https://github.com/Its1Zero/cve-2025-57819-exploithttps://github.com/JakovBis/CVE-2025-57819_FreePBX-PoChttps://github.com/JazzTheRabbit/FreePBX-SQLi-RCEhttps://github.com/Jeanback1/CVE-2025-57819-exploithttps://github.com/jf-gondim/freepbx-endpoint-sqli-rcehttps://github.com/K3ysTr0K3R/CVE-2025-57819https://github.com/MuhammadWaseem29/SQL-Injection-and-RCE_CVE-2025-57819https://github.com/Neobee714/CVE-2025-57819-POChttps://github.com/net-hex/CVE-2025-57819https://github.com/orange0Mint/CVE-2025-57819_FreePBXhttps://github.com/ozcanpng/CVE-2025-57819-FreePBX-RCE2Roothttps://github.com/r3vpwnx/CVE-2025-57819https://github.com/rxerium/CVE-2025-57819https://github.com/Sucuri-Labs/CVE-2025-57819-ioc-checkhttps://github.com/TeteREN/CVE-2025-57819-RCEhttps://github.com/watchtowrlabs/watchTowr-vs-FreePBX-CVE-2025-57819https://github.com/xV4nd3Rx/CVE-2025-57819_FreePBX-PoChttps://github.com/YuvrajSHAD/FreePBX-CVE-2025-57819

    Related CVEs

    CVE-2025-67736 (CVSS 8.6) — The FreePBX module tts (Text to Speech) for FreePBX, an open-source web-based graphical user interface (GUI) t…
    CVE-2025-67722 (CVSS 5.7) — FreePBX is an open-source web-based graphical user interface (GUI) that manages Asterisk. Prior to versions 16…
    CVE-2024-58294 (CVSS 8.7) — FreePBX 16 contains an authenticated remote code execution vulnerability in the API module that allows attacke…
    CVE-2025-62173 (CVSS 8.6) — ## Summary Authenticated SQL Injection Vulnerability in Endpoint Module Rest API…
    CVE-2025-64328 (CVSS 8.6) — FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.3…
    CVE-2025-59429 (CVSS 8.5) — FreePBX is an open source GUI for managing Asterisk. In versions prior to 16.0.68.39 for FreePBX 16 and versio…
    CVE-2025-59056 (CVSS 6.6) — FreePBX is an open-source web-based graphical user interface. In FreePBX 15, 16, and 17, malicious connections…
    CVE-2025-55211 (CVSS 6.3) — FreePBX is an open-source web-based graphical user interface. From 17.0.19.11 to before 17.0.21, authenticated…
    CVE-2025-55739 (CVSS 5.1) — api is a module for FreePBX@, which is an open source GUI that controls and manages Asterisk© (PBX). In versio…
    CVE-2025-55209 (CVSS 5.1) — contactmanager is a module for FreePBX@, which is an open source GUI that controls and manages Asterisk© (PBX)…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High