Mwtcmi vulnerabilities
We track 3 vulnerabilities in Mwtcmi products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on July 16, 2026.
Latest Mwtcmi vulnerabilities
- 9.3 Critical severity
frogman: Missing Authorization
Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.3, PERM_READ access was sufficient to call fm_list_managers, fm_list_pinsets, fm_show_context, fm_get_mcp_config, fm_backup_status, fm_whos_calling, fm_run_saved_query, and fm_diagnos
- 7.4 High severity
frogman: Plaintext Storage of a Password
Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, Frogman stored API tokens generated by Tools/CreateApiToken.php:33-36 as raw bin2hex(random_bytes(32)) strings in oc_api_tokens, and Frogman.class.php:78 authenticated the X-Frogma
- 9.9 Critical severity
frogman: Improper Control of Generation of Code
Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_dialplan_apply accepted template parameters including greeting, dest, url, extension, code, and file, and Tools/DialplanApply.php wrote Dialplan/Templates.php output to extensio