|
About the Blog category
|
|
1
|
2053
|
October 22, 2024
|
|
:green_circle: Authenticated privilege escalation in API module via SQL injection in Pinsets
|
|
0
|
6
|
September 29, 2026
|
|
:green_circle: Authenticated low-privilege UCP user can modify contacts of other users
|
|
0
|
4
|
September 29, 2026
|
|
:orange_circle: Authenticated low-privilege UCP user can read full database via SQL injection
|
|
0
|
5
|
September 29, 2026
|
|
:green_circle: Authenticated admin SQL injection via SIPSTATION module
|
|
0
|
4
|
September 29, 2026
|
|
:cowboy_hat_face: Telephony Cards: The Last Roundup, and What Comes Next
|
|
0
|
63
|
September 18, 2026
|
|
Looking for a More Predictable Phone System than 3CX? Choose FreePBX :frog:
|
|
0
|
69
|
September 18, 2026
|
|
:magnifying_glass_tilted_right: Searching for a Mitel Alternative? Consider FreePBX for your Business
|
|
0
|
49
|
September 18, 2026
|
|
:green_circle: Authenticated Root OS Command Injection in Backup GraphQL restoreBackup
|
|
0
|
35
|
September 17, 2026
|
|
:green_circle: Authenticated Second-Order OS Command Execution in FreePBX Recordings via Dialplan Injection
|
|
0
|
36
|
September 17, 2026
|
|
:green_circle: Authenticated RCE in UCP via AMI
|
|
0
|
38
|
September 17, 2026
|
|
:green_circle: Authenticated admin can read any file via call recording report
|
|
0
|
33
|
September 17, 2026
|
|
:orange_circle: Authenticated RCE via unsafe unserialize in backup restore
|
|
0
|
32
|
September 17, 2026
|
|
:orange_circle: Unauthenticated inbound CallerID becomes stored XSS in CEL Reports
|
|
0
|
45
|
September 17, 2026
|
|
:green_circle: Authenticated but Broken access control in the FreePBX framework GraphQL API
|
|
0
|
51
|
August 31, 2026
|
|
:green_circle: Authenticated admin with limited privileges can escalate perms via Framework BMO AJAX dispatcher
|
|
1
|
44
|
September 23, 2026
|
|
:orange_circle: Authenticated RCE in FindMeFollowMe function of Sangoma Connect
|
|
1
|
47
|
September 23, 2026
|
|
:green_circle: Authenticated Backup Metadata Hooks Execution Bypass
|
|
1
|
39
|
September 23, 2026
|
|
:green_circle: Authenticated Backup GraphQL Restore Filename Command Injection
|
|
1
|
42
|
September 23, 2026
|
|
:orange_circle: Unauthenticated RCE via SQL injection in Sangoma Connect RT API login
|
|
1
|
74
|
September 20, 2026
|
|
:orange_circle: Unauthenticated Missing Authorization in FreePBX UCP allows reset/overwrite of any user's dashboard templates
|
|
1
|
70
|
September 20, 2026
|
|
Softphone access is changing as module licenses expire
|
|
2
|
162
|
September 7, 2026
|
|
:orange_circle: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover
|
|
3
|
138
|
August 16, 2026
|
|
:red_circle: Unauthenticated remote code execution in FreePBX UCP via socket.io namespace auth bypass and AMI action injection
|
|
4
|
241
|
August 16, 2026
|
|
:green_circle: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted Backup
|
|
1
|
53
|
August 15, 2026
|
|
:green_circle: Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files
|
|
1
|
52
|
August 15, 2026
|
|
:green_circle: Authenticated TTS AGI Command Injection Through TTS Name
|
|
1
|
57
|
August 15, 2026
|
|
Authenticated Arbitrary SSH Key Injection via Backup Module
|
|
1
|
59
|
August 8, 2026
|
|
Authenticated API generatedocs Host Command Injection
|
|
1
|
57
|
August 8, 2026
|
|
Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module
|
|
14
|
296
|
July 17, 2026
|