endpoint vulnerabilities

3 known vulnerabilities in endpoint from FreePBX. 3 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.6 High severity

  endpoint: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2025-61675Oct 14, 2025FreePBXEPSS 40.3%

  FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17, the Endpoint Manager module contains authenticated SQL injection vulnerabilities

• 8.6 High severity

  endpoint: Improper Neutralization of Special Elements used in an OS Command

  CVE-2025-59051Oct 14, 2025FreePBX

  The FreePBX Endpoint Manager module includes a Network Scanning feature that provides web-based access to nmap functionality for network device discovery. In Endpoint Manager 16 before 16.0.92 and 17 before 17.0.6, insufficiently sanitized user-supplied input

• 9.8 Critical severity

  Sangoma FreePBX Authentication Bypass Exploited

  CVE-2025-57819Aug 28, 2025FreePBXEPSS 95.2%

  FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation