{"users":[{"id":-1,"username":"system","name":"system","avatar_template":"/uploads/default/original/3X/f/7/f7056d57e04fdbf71c6ad967e1ced351317f5c3f.png","admin":true,"moderator":true,"trust_level":4},{"id":33132,"username":"penguinpbx","name":"C. Maj","avatar_template":"/user_avatar/community.freepbx.org/penguinpbx/{size}/29933_2.png","primary_group_name":"sangoma","flair_name":"sangoma","flair_url":"/uploads/default/original/3X/e/6/e6469ea58fa1a9905eeffd5c695d810774f6bc41.png","flair_group_id":47,"admin":true,"moderator":true,"trust_level":4},{"id":13909,"username":"miken32","name":"miken32","avatar_template":"/user_avatar/community.freepbx.org/miken32/{size}/30291_2.png","trust_level":3},{"id":132765,"username":"tomk","name":"TommyK","avatar_template":"/letter_avatar_proxy/v4/letter/t/ee59a6/{size}.png","trust_level":2},{"id":126184,"username":"psingh","name":"Pushkar Singh","avatar_template":"/letter_avatar_proxy/v4/letter/p/76d3ee/{size}.png","primary_group_name":"sangoma","flair_name":"sangoma","flair_url":"/uploads/default/original/3X/e/6/e6469ea58fa1a9905eeffd5c695d810774f6bc41.png","flair_group_id":47,"admin":true,"moderator":true,"trust_level":4},{"id":140208,"username":"dmkol33","name":"dmitriy","avatar_template":"/letter_avatar_proxy/v4/letter/d/d9b06d/{size}.png","trust_level":0},{"id":5207,"username":"jfinstrom","name":"James Finstrom","avatar_template":"/user_avatar/community.freepbx.org/jfinstrom/{size}/12705_2.png","trust_level":2},{"id":116883,"username":"BlazeStudios","name":"Tom Ray","avatar_template":"/letter_avatar_proxy/v4/letter/b/e0b2c6/{size}.png","flair_name":"community_coder","flair_url":"/uploads/default/original/3X/9/3/93c7c7eae07c85d96352a873a62e2d8d9fe04da2.png","flair_group_id":48,"trust_level":3},{"id":124916,"username":"nickzed","name":"NickZed","avatar_template":"/letter_avatar_proxy/v4/letter/n/b2d939/{size}.png","trust_level":2},{"id":24924,"username":"billsimon","name":"Bill Simon","avatar_template":"/user_avatar/community.freepbx.org/billsimon/{size}/8369_2.png","flair_name":"community_coder","flair_url":"/uploads/default/original/3X/9/3/93c7c7eae07c85d96352a873a62e2d8d9fe04da2.png","flair_group_id":48,"trust_level":3}],"primary_groups":[{"id":47,"name":"sangoma"}],"flair_groups":[{"id":47,"name":"sangoma","flair_url":"/uploads/default/original/3X/e/6/e6469ea58fa1a9905eeffd5c695d810774f6bc41.png","flair_bg_color":"","flair_color":""},{"id":48,"name":"community_coder","flair_url":"/uploads/default/original/3X/9/3/93c7c7eae07c85d96352a873a62e2d8d9fe04da2.png","flair_bg_color":"","flair_color":""}],"topic_list":{"can_create_topic":false,"more_topics_url":"/c/blog/security/55?page=1","per_page":30,"top_tags":[{"id":114,"name":"security","slug":"security"},{"id":115,"name":"v17","slug":"v17"},{"id":118,"name":"v16","slug":"v16"},{"id":44,"name":"ucp","slug":"ucp"},{"id":128,"name":"backup-restore","slug":"backup-restore"},{"id":140,"name":"graphql","slug":"graphql"},{"id":57,"name":"backup","slug":"backup"},{"id":74,"name":"framework","slug":"framework"},{"id":168,"name":"acp","slug":"acp"},{"id":33,"name":"freepbx","slug":"freepbx"},{"id":3,"name":"asterisk","slug":"asterisk"},{"id":22,"name":"bug","slug":"bug"},{"id":31,"name":"firewall","slug":"firewall"},{"id":6,"name":"moh","slug":"moh"},{"id":69,"name":"callerid","slug":"callerid"},{"id":81,"name":"cdr","slug":"cdr"},{"id":138,"name":"cel","slug":"cel"},{"id":9,"name":"configuration","slug":"configuration"},{"id":46,"name":"contact-manager","slug":"contact-manager"},{"id":8,"name":"core","slug":"core"},{"id":101,"name":"dashboard","slug":"dashboard"},{"id":77,"name":"dialplan","slug":"dialplan"},{"id":62,"name":"letsencrypt","slug":"letsencrypt"},{"id":165,"name":"missedcall","slug":"missedcall"},{"id":17,"name":"modules","slug":"modules"},{"id":173,"name":"restore-backup","slug":"restore-backup"},{"id":16,"name":"siptrunk","slug":"siptrunk"},{"id":72,"name":"superfecta","slug":"superfecta"},{"id":166,"name":"tts","slug":"tts"}],"topics":[{"fancy_title":"About the Security category","id":22244,"title":"About the Security category","slug":"about-the-security-category","posts_count":3,"reply_count":0,"highest_post_number":4,"image_url":null,"created_at":"2014-06-06T18:47:15.051Z","last_posted_at":"2024-10-24T16:45:36.677Z","bumped":true,"bumped_at":"2024-10-24T16:44:45.191Z","archetype":"regular","unseen":false,"pinned":true,"unpinned":null,"excerpt":"This category contains posts related to security announcements and updates. Please review the FreePBX Security Policy on GitHub before posting here. There is also a FreePBX Security section of the forums.","visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"tags":[],"tags_descriptions":{},"views":1277,"like_count":0,"has_summary":false,"last_poster_username":"penguinpbx","category_id":55,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":null,"description":"Original Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":33132,"primary_group_id":47,"flair_group_id":47}]},{"fancy_title":":green_circle: Authenticated low-privilege UCP user can modify contacts of other users","id":110312,"title":":green_circle: Authenticated low-privilege UCP user can modify contacts of other users","slug":"authenticated-low-privilege-ucp-user-can-modify-contacts-of-other-users","posts_count":7,"reply_count":3,"highest_post_number":7,"image_url":null,"created_at":"2026-09-29T21:32:36.358Z","last_posted_at":"2026-10-01T14:21:14.964Z","bumped":true,"bumped_at":"2026-10-01T14:21:14.964Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"unicode_title":"🟢 Authenticated low-privilege UCP user can modify contacts of other users","tags":[{"id":115,"name":"v17","slug":"v17"},{"id":44,"name":"ucp","slug":"ucp"},{"id":118,"name":"v16","slug":"v16"},{"id":114,"name":"security","slug":"security"},{"id":46,"name":"contact-manager","slug":"contact-manager"}],"tags_descriptions":{},"views":143,"like_count":2,"has_summary":false,"last_poster_username":"dmkol33","category_id":55,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":null,"description":"Original Poster","user_id":33132,"primary_group_id":47,"flair_group_id":47},{"extras":null,"description":"Frequent Poster","user_id":13909,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":132765,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":126184,"primary_group_id":47,"flair_group_id":47},{"extras":"latest","description":"Most Recent Poster","user_id":140208,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":":green_circle: Authenticated privilege escalation in API module via SQL injection in Pinsets","id":110313,"title":":green_circle: Authenticated privilege escalation in API module via SQL injection in Pinsets","slug":"authenticated-privilege-escalation-in-api-module-via-sql-injection-in-pinsets","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2026-09-29T21:38:24.608Z","last_posted_at":"2026-09-29T21:38:24.923Z","bumped":true,"bumped_at":"2026-09-29T21:38:24.923Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"unicode_title":"🟢 Authenticated privilege escalation in API module via SQL injection in Pinsets","tags":[{"id":115,"name":"v17","slug":"v17"},{"id":118,"name":"v16","slug":"v16"},{"id":114,"name":"security","slug":"security"},{"id":140,"name":"graphql","slug":"graphql"}],"tags_descriptions":{},"views":50,"like_count":0,"has_summary":false,"last_poster_username":"penguinpbx","category_id":55,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user_id":33132,"primary_group_id":47,"flair_group_id":47}]},{"fancy_title":":orange_circle: Authenticated low-privilege UCP user can read full database via SQL injection","id":110311,"title":":orange_circle: Authenticated low-privilege UCP user can read full database via SQL injection","slug":"authenticated-low-privilege-ucp-user-can-read-full-database-via-sql-injection","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2026-09-29T21:29:11.737Z","last_posted_at":"2026-09-29T21:29:12.035Z","bumped":true,"bumped_at":"2026-09-29T21:29:12.035Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"unicode_title":"🟠 Authenticated low-privilege UCP user can read full database via SQL injection","tags":[{"id":115,"name":"v17","slug":"v17"},{"id":44,"name":"ucp","slug":"ucp"},{"id":118,"name":"v16","slug":"v16"},{"id":114,"name":"security","slug":"security"}],"tags_descriptions":{},"views":43,"like_count":0,"has_summary":false,"last_poster_username":"penguinpbx","category_id":55,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user_id":33132,"primary_group_id":47,"flair_group_id":47}]},{"fancy_title":":green_circle: Authenticated admin SQL injection via SIPSTATION module","id":110309,"title":":green_circle: Authenticated admin SQL injection via SIPSTATION module","slug":"authenticated-admin-sql-injection-via-sipstation-module","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2026-09-29T21:26:42.946Z","last_posted_at":"2026-09-29T21:26:43.290Z","bumped":true,"bumped_at":"2026-09-29T21:26:43.290Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"unicode_title":"🟢 Authenticated admin SQL injection via SIPSTATION module","tags":[{"id":16,"name":"siptrunk","slug":"siptrunk"},{"id":115,"name":"v17","slug":"v17"},{"id":114,"name":"security","slug":"security"},{"id":168,"name":"acp","slug":"acp"}],"tags_descriptions":{},"views":37,"like_count":0,"has_summary":false,"last_poster_username":"penguinpbx","category_id":55,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user_id":33132,"primary_group_id":47,"flair_group_id":47}]},{"fancy_title":":green_circle: Authenticated Root OS Command Injection in Backup GraphQL restoreBackup","id":110265,"title":":green_circle: Authenticated Root OS Command Injection in Backup GraphQL restoreBackup","slug":"authenticated-root-os-command-injection-in-backup-graphql-restorebackup","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2026-09-17T04:28:42.723Z","last_posted_at":"2026-09-17T04:28:43.029Z","bumped":true,"bumped_at":"2026-09-17T04:28:43.029Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"unicode_title":"🟢 Authenticated Root OS Command Injection in Backup GraphQL restoreBackup","tags":[{"id":115,"name":"v17","slug":"v17"},{"id":118,"name":"v16","slug":"v16"},{"id":114,"name":"security","slug":"security"},{"id":140,"name":"graphql","slug":"graphql"},{"id":173,"name":"restore-backup","slug":"restore-backup"}],"tags_descriptions":{},"views":37,"like_count":0,"has_summary":false,"last_poster_username":"penguinpbx","category_id":55,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user_id":33132,"primary_group_id":47,"flair_group_id":47}]},{"fancy_title":":green_circle: Authenticated Second-Order OS Command Execution in FreePBX Recordings via Dialplan Injection","id":110264,"title":":green_circle: Authenticated Second-Order OS Command Execution in FreePBX Recordings via Dialplan Injection","slug":"authenticated-second-order-os-command-execution-in-freepbx-recordings-via-dialplan-injection","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2026-09-17T04:26:11.445Z","last_posted_at":"2026-09-17T04:26:11.744Z","bumped":true,"bumped_at":"2026-09-17T04:26:11.744Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"unicode_title":"🟢 Authenticated Second-Order OS Command Execution in FreePBX Recordings via Dialplan Injection","tags":[{"id":115,"name":"v17","slug":"v17"},{"id":118,"name":"v16","slug":"v16"},{"id":114,"name":"security","slug":"security"},{"id":77,"name":"dialplan","slug":"dialplan"},{"id":168,"name":"acp","slug":"acp"}],"tags_descriptions":{},"views":44,"like_count":0,"has_summary":false,"last_poster_username":"penguinpbx","category_id":55,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user_id":33132,"primary_group_id":47,"flair_group_id":47}]},{"fancy_title":":green_circle: Authenticated RCE in UCP via AMI","id":110263,"title":":green_circle: Authenticated RCE in UCP via AMI","slug":"authenticated-rce-in-ucp-via-ami","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2026-09-17T04:23:32.671Z","last_posted_at":"2026-09-17T04:23:33.011Z","bumped":true,"bumped_at":"2026-09-17T04:23:33.011Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"unicode_title":"🟢 Authenticated RCE in UCP via AMI","tags":[{"id":115,"name":"v17","slug":"v17"},{"id":44,"name":"ucp","slug":"ucp"},{"id":118,"name":"v16","slug":"v16"},{"id":114,"name":"security","slug":"security"},{"id":74,"name":"framework","slug":"framework"}],"tags_descriptions":{},"views":44,"like_count":0,"has_summary":false,"last_poster_username":"penguinpbx","category_id":55,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user_id":33132,"primary_group_id":47,"flair_group_id":47}]},{"fancy_title":":green_circle: Authenticated admin can read any file via call recording report","id":110262,"title":":green_circle: Authenticated admin can read any file via call recording report","slug":"authenticated-admin-can-read-any-file-via-call-recording-report","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2026-09-17T04:20:38.569Z","last_posted_at":"2026-09-17T04:20:38.850Z","bumped":true,"bumped_at":"2026-09-17T04:20:38.850Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"unicode_title":"🟢 Authenticated admin can read any file via call recording report","tags":[{"id":115,"name":"v17","slug":"v17"},{"id":118,"name":"v16","slug":"v16"},{"id":114,"name":"security","slug":"security"},{"id":168,"name":"acp","slug":"acp"}],"tags_descriptions":{},"views":41,"like_count":0,"has_summary":false,"last_poster_username":"penguinpbx","category_id":55,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user_id":33132,"primary_group_id":47,"flair_group_id":47}]},{"fancy_title":":orange_circle: Authenticated RCE via unsafe unserialize in backup restore","id":110261,"title":":orange_circle: Authenticated RCE via unsafe unserialize in backup restore","slug":"authenticated-rce-via-unsafe-unserialize-in-backup-restore","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2026-09-17T04:17:05.554Z","last_posted_at":"2026-09-17T04:17:05.859Z","bumped":true,"bumped_at":"2026-09-17T04:17:05.859Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"unicode_title":"🟠 Authenticated RCE via unsafe unserialize in backup restore","tags":[{"id":115,"name":"v17","slug":"v17"},{"id":118,"name":"v16","slug":"v16"},{"id":114,"name":"security","slug":"security"},{"id":128,"name":"backup-restore","slug":"backup-restore"}],"tags_descriptions":{},"views":34,"like_count":0,"has_summary":false,"last_poster_username":"penguinpbx","category_id":55,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user_id":33132,"primary_group_id":47,"flair_group_id":47}]},{"fancy_title":":orange_circle: Unauthenticated inbound CallerID becomes stored XSS in CEL Reports","id":110260,"title":":orange_circle: Unauthenticated inbound CallerID becomes stored XSS in CEL Reports","slug":"unauthenticated-inbound-callerid-becomes-stored-xss-in-cel-reports","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2026-09-17T04:13:54.972Z","last_posted_at":"2026-09-17T04:13:55.310Z","bumped":true,"bumped_at":"2026-09-17T04:13:55.310Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"unicode_title":"🟠 Unauthenticated inbound CallerID becomes stored XSS in CEL Reports","tags":[{"id":115,"name":"v17","slug":"v17"},{"id":118,"name":"v16","slug":"v16"},{"id":114,"name":"security","slug":"security"},{"id":69,"name":"callerid","slug":"callerid"},{"id":138,"name":"cel","slug":"cel"}],"tags_descriptions":{},"views":47,"like_count":0,"has_summary":false,"last_poster_username":"penguinpbx","category_id":55,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user_id":33132,"primary_group_id":47,"flair_group_id":47}]},{"fancy_title":":green_circle: Authenticated but Broken access control in the FreePBX framework GraphQL API","id":110179,"title":":green_circle: Authenticated but Broken access control in the FreePBX framework GraphQL API","slug":"authenticated-but-broken-access-control-in-the-freepbx-framework-graphql-api","posts_count":2,"reply_count":0,"highest_post_number":2,"image_url":null,"created_at":"2026-08-31T14:32:46.706Z","last_posted_at":"2026-09-30T14:33:17.131Z","bumped":true,"bumped_at":"2026-08-31T14:32:47.137Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"unicode_title":"🟢 Authenticated but Broken access control in the FreePBX framework GraphQL API","tags":[{"id":115,"name":"v17","slug":"v17"},{"id":118,"name":"v16","slug":"v16"},{"id":114,"name":"security","slug":"security"},{"id":74,"name":"framework","slug":"framework"},{"id":140,"name":"graphql","slug":"graphql"}],"tags_descriptions":{},"views":59,"like_count":0,"has_summary":false,"last_poster_username":"system","category_id":55,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":null,"description":"Original Poster","user_id":33132,"primary_group_id":47,"flair_group_id":47},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":":green_circle: Authenticated admin with limited privileges can escalate perms via Framework BMO AJAX dispatcher","id":110138,"title":":green_circle: Authenticated admin with limited privileges can escalate perms via Framework BMO AJAX dispatcher","slug":"authenticated-admin-with-limited-privileges-can-escalate-perms-via-framework-bmo-ajax-dispatcher","posts_count":2,"reply_count":0,"highest_post_number":2,"image_url":null,"created_at":"2026-08-24T17:51:30.950Z","last_posted_at":"2026-09-23T17:52:21.487Z","bumped":true,"bumped_at":"2026-08-24T17:51:31.228Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"unicode_title":"🟢 Authenticated admin with limited privileges can escalate perms via Framework BMO AJAX dispatcher","tags":[{"id":115,"name":"v17","slug":"v17"},{"id":118,"name":"v16","slug":"v16"},{"id":114,"name":"security","slug":"security"},{"id":74,"name":"framework","slug":"framework"}],"tags_descriptions":{},"views":50,"like_count":0,"has_summary":false,"last_poster_username":"system","category_id":55,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":null,"description":"Original Poster","user_id":33132,"primary_group_id":47,"flair_group_id":47},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":":orange_circle: Authenticated RCE in FindMeFollowMe function of Sangoma Connect","id":110137,"title":":orange_circle: Authenticated RCE in FindMeFollowMe function of Sangoma Connect","slug":"authenticated-rce-in-findmefollowme-function-of-sangoma-connect","posts_count":2,"reply_count":0,"highest_post_number":2,"image_url":null,"created_at":"2026-08-24T17:47:24.321Z","last_posted_at":"2026-09-23T17:48:19.510Z","bumped":true,"bumped_at":"2026-08-24T17:47:24.561Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"unicode_title":"🟠 Authenticated RCE in FindMeFollowMe function of Sangoma Connect","tags":[{"id":115,"name":"v17","slug":"v17"},{"id":118,"name":"v16","slug":"v16"},{"id":114,"name":"security","slug":"security"}],"tags_descriptions":{},"views":53,"like_count":0,"has_summary":false,"last_poster_username":"system","category_id":55,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":null,"description":"Original Poster","user_id":33132,"primary_group_id":47,"flair_group_id":47},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":":green_circle: Authenticated Backup Metadata Hooks Execution Bypass","id":110136,"title":":green_circle: Authenticated Backup Metadata Hooks Execution Bypass","slug":"authenticated-backup-metadata-hooks-execution-bypass","posts_count":2,"reply_count":0,"highest_post_number":2,"image_url":null,"created_at":"2026-08-24T17:40:37.209Z","last_posted_at":"2026-09-23T17:41:15.112Z","bumped":true,"bumped_at":"2026-08-24T17:40:37.600Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"unicode_title":"🟢 Authenticated Backup Metadata Hooks Execution Bypass","tags":[{"id":115,"name":"v17","slug":"v17"},{"id":57,"name":"backup","slug":"backup"},{"id":118,"name":"v16","slug":"v16"},{"id":114,"name":"security","slug":"security"},{"id":128,"name":"backup-restore","slug":"backup-restore"}],"tags_descriptions":{},"views":44,"like_count":0,"has_summary":false,"last_poster_username":"system","category_id":55,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":null,"description":"Original Poster","user_id":33132,"primary_group_id":47,"flair_group_id":47},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":":green_circle: Authenticated Backup GraphQL Restore Filename Command Injection","id":110135,"title":":green_circle: Authenticated Backup GraphQL Restore Filename Command Injection","slug":"authenticated-backup-graphql-restore-filename-command-injection","posts_count":2,"reply_count":0,"highest_post_number":2,"image_url":null,"created_at":"2026-08-24T17:33:44.543Z","last_posted_at":"2026-09-23T17:34:14.094Z","bumped":true,"bumped_at":"2026-08-24T17:33:44.860Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"unicode_title":"🟢 Authenticated Backup GraphQL Restore Filename Command Injection","tags":[{"id":115,"name":"v17","slug":"v17"},{"id":57,"name":"backup","slug":"backup"},{"id":118,"name":"v16","slug":"v16"},{"id":114,"name":"security","slug":"security"},{"id":128,"name":"backup-restore","slug":"backup-restore"}],"tags_descriptions":{},"views":48,"like_count":0,"has_summary":false,"last_poster_username":"system","category_id":55,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":null,"description":"Original Poster","user_id":33132,"primary_group_id":47,"flair_group_id":47},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":":orange_circle: Unauthenticated RCE via SQL injection in Sangoma Connect RT API login","id":110126,"title":":orange_circle: Unauthenticated RCE via SQL injection in Sangoma Connect RT API login","slug":"unauthenticated-rce-via-sql-injection-in-sangoma-connect-rt-api-login","posts_count":2,"reply_count":0,"highest_post_number":2,"image_url":null,"created_at":"2026-08-21T20:17:05.204Z","last_posted_at":"2026-09-20T20:17:45.637Z","bumped":true,"bumped_at":"2026-08-21T20:17:05.512Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"unicode_title":"🟠 Unauthenticated RCE via SQL injection in Sangoma Connect RT API login","tags":[{"id":115,"name":"v17","slug":"v17"},{"id":31,"name":"firewall","slug":"firewall"},{"id":118,"name":"v16","slug":"v16"},{"id":114,"name":"security","slug":"security"}],"tags_descriptions":{},"views":78,"like_count":0,"has_summary":false,"last_poster_username":"system","category_id":55,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":null,"description":"Original Poster","user_id":33132,"primary_group_id":47,"flair_group_id":47},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":":orange_circle: Unauthenticated Missing Authorization in FreePBX UCP allows reset/overwrite of any user’s dashboard templates","id":110124,"title":":orange_circle: Unauthenticated Missing Authorization in FreePBX UCP allows reset/overwrite of any user's dashboard templates","slug":"unauthenticated-missing-authorization-in-freepbx-ucp-allows-reset-overwrite-of-any-users-dashboard-templates","posts_count":2,"reply_count":0,"highest_post_number":2,"image_url":null,"created_at":"2026-08-21T20:08:49.351Z","last_posted_at":"2026-09-20T20:09:41.612Z","bumped":true,"bumped_at":"2026-08-21T20:08:49.729Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"unicode_title":"🟠 Unauthenticated Missing Authorization in FreePBX UCP allows reset/overwrite of any user's dashboard templates","tags":[{"id":115,"name":"v17","slug":"v17"},{"id":44,"name":"ucp","slug":"ucp"},{"id":118,"name":"v16","slug":"v16"},{"id":114,"name":"security","slug":"security"}],"tags_descriptions":{},"views":74,"like_count":0,"has_summary":false,"last_poster_username":"system","category_id":55,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":null,"description":"Original Poster","user_id":33132,"primary_group_id":47,"flair_group_id":47},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":":orange_circle: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover","id":109906,"title":":orange_circle: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover","slug":"unauthenticated-sql-injection-in-freepbx-missedcall-via-inbound-caller-id-name-leads-to-administrator-takeover","posts_count":4,"reply_count":1,"highest_post_number":4,"image_url":null,"created_at":"2026-07-16T22:07:10.332Z","last_posted_at":"2026-08-16T20:59:21.898Z","bumped":true,"bumped_at":"2026-07-17T20:58:31.880Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"unicode_title":"🟠 Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover","tags":[{"id":115,"name":"v17","slug":"v17"},{"id":118,"name":"v16","slug":"v16"},{"id":114,"name":"security","slug":"security"},{"id":165,"name":"missedcall","slug":"missedcall"}],"tags_descriptions":{},"views":140,"like_count":0,"has_summary":false,"last_poster_username":"system","category_id":55,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":null,"description":"Original Poster","user_id":33132,"primary_group_id":47,"flair_group_id":47},{"extras":null,"description":"Frequent Poster","user_id":5207,"primary_group_id":null,"flair_group_id":null},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":":red_circle: Unauthenticated remote code execution in FreePBX UCP via socket.io namespace auth bypass and AMI action injection","id":109905,"title":":red_circle: Unauthenticated remote code execution in FreePBX UCP via socket.io namespace auth bypass and AMI action injection","slug":"unauthenticated-remote-code-execution-in-freepbx-ucp-via-socket-io-namespace-auth-bypass-and-ami-action-injection","posts_count":5,"reply_count":0,"highest_post_number":5,"image_url":null,"created_at":"2026-07-16T21:58:47.644Z","last_posted_at":"2026-08-16T14:52:15.158Z","bumped":true,"bumped_at":"2026-07-17T14:51:57.912Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"unicode_title":"🔴 Unauthenticated remote code execution in FreePBX UCP via socket.io namespace auth bypass and AMI action injection","tags":[{"id":115,"name":"v17","slug":"v17"},{"id":44,"name":"ucp","slug":"ucp"},{"id":114,"name":"security","slug":"security"}],"tags_descriptions":{},"views":250,"like_count":1,"has_summary":false,"last_poster_username":"system","category_id":55,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":null,"description":"Original Poster","user_id":33132,"primary_group_id":47,"flair_group_id":47},{"extras":null,"description":"Frequent Poster","user_id":116883,"primary_group_id":null,"flair_group_id":48},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":":green_circle: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted Backup","id":109909,"title":":green_circle: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted Backup","slug":"authenticated-framework-authtype-can-be-restored-from-a-crafted-backup","posts_count":2,"reply_count":0,"highest_post_number":2,"image_url":null,"created_at":"2026-07-16T22:19:41.175Z","last_posted_at":"2026-08-15T22:20:20.245Z","bumped":true,"bumped_at":"2026-07-16T22:19:41.478Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"unicode_title":"🟢 Authenticated Framework AUTHTYPE Can Be Restored From a Crafted Backup","tags":[{"id":115,"name":"v17","slug":"v17"},{"id":57,"name":"backup","slug":"backup"},{"id":118,"name":"v16","slug":"v16"},{"id":114,"name":"security","slug":"security"},{"id":128,"name":"backup-restore","slug":"backup-restore"}],"tags_descriptions":{},"views":54,"like_count":0,"has_summary":false,"last_poster_username":"system","category_id":55,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":null,"description":"Original Poster","user_id":33132,"primary_group_id":47,"flair_group_id":47},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":":green_circle: Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files","id":109908,"title":":green_circle: Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files","slug":"authenticated-freepbx-music-rce-via-mpg123-and-asterisk-call-files","posts_count":2,"reply_count":0,"highest_post_number":2,"image_url":null,"created_at":"2026-07-16T22:15:34.915Z","last_posted_at":"2026-08-15T22:16:21.401Z","bumped":true,"bumped_at":"2026-07-16T22:15:35.159Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"unicode_title":"🟢 Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files","tags":[{"id":115,"name":"v17","slug":"v17"},{"id":114,"name":"security","slug":"security"},{"id":6,"name":"moh","slug":"moh"}],"tags_descriptions":{},"views":53,"like_count":0,"has_summary":false,"last_poster_username":"system","category_id":55,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":null,"description":"Original Poster","user_id":33132,"primary_group_id":47,"flair_group_id":47},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":":green_circle: Authenticated TTS AGI Command Injection Through TTS Name","id":109907,"title":":green_circle: Authenticated TTS AGI Command Injection Through TTS Name","slug":"authenticated-tts-agi-command-injection-through-tts-name","posts_count":2,"reply_count":0,"highest_post_number":2,"image_url":null,"created_at":"2026-07-16T22:13:14.138Z","last_posted_at":"2026-08-15T22:13:26.440Z","bumped":true,"bumped_at":"2026-07-16T22:13:14.431Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"unicode_title":"🟢 Authenticated TTS AGI Command Injection Through TTS Name","tags":[{"id":115,"name":"v17","slug":"v17"},{"id":118,"name":"v16","slug":"v16"},{"id":114,"name":"security","slug":"security"},{"id":166,"name":"tts","slug":"tts"}],"tags_descriptions":{},"views":58,"like_count":0,"has_summary":false,"last_poster_username":"system","category_id":55,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":null,"description":"Original Poster","user_id":33132,"primary_group_id":47,"flair_group_id":47},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Authenticated Arbitrary SSH Key Injection via Backup Module","id":109864,"title":"Authenticated Arbitrary SSH Key Injection via Backup Module","slug":"authenticated-arbitrary-ssh-key-injection-via-backup-module","posts_count":2,"reply_count":0,"highest_post_number":2,"image_url":null,"created_at":"2026-07-09T13:50:33.447Z","last_posted_at":"2026-08-08T13:51:30.384Z","bumped":true,"bumped_at":"2026-07-09T13:50:33.712Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"tags":[{"id":115,"name":"v17","slug":"v17"},{"id":57,"name":"backup","slug":"backup"}],"tags_descriptions":{},"views":59,"like_count":0,"has_summary":false,"last_poster_username":"system","category_id":55,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":null,"description":"Original Poster","user_id":33132,"primary_group_id":47,"flair_group_id":47},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Authenticated API generatedocs Host Command Injection","id":109863,"title":"Authenticated API generatedocs Host Command Injection","slug":"authenticated-api-generatedocs-host-command-injection","posts_count":2,"reply_count":0,"highest_post_number":2,"image_url":null,"created_at":"2026-07-09T13:04:47.229Z","last_posted_at":"2026-08-08T13:05:19.186Z","bumped":true,"bumped_at":"2026-07-09T13:04:47.558Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"tags":[{"id":115,"name":"v17","slug":"v17"},{"id":140,"name":"graphql","slug":"graphql"}],"tags_descriptions":{},"views":59,"like_count":0,"has_summary":false,"last_poster_username":"system","category_id":55,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":null,"description":"Original Poster","user_id":33132,"primary_group_id":47,"flair_group_id":47},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module","id":109688,"title":"Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module","slug":"authenticated-remote-code-execution-in-freepbx-music-on-hold-moh-module","posts_count":15,"reply_count":10,"highest_post_number":15,"image_url":null,"created_at":"2026-06-10T13:38:06.659Z","last_posted_at":"2026-07-17T19:39:30.319Z","bumped":true,"bumped_at":"2026-06-17T19:38:33.016Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"tags":[{"id":3,"name":"asterisk","slug":"asterisk"},{"id":115,"name":"v17","slug":"v17"},{"id":118,"name":"v16","slug":"v16"},{"id":114,"name":"security","slug":"security"},{"id":6,"name":"moh","slug":"moh"}],"tags_descriptions":{},"views":304,"like_count":1,"has_summary":false,"last_poster_username":"system","category_id":55,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":null,"description":"Original Poster","user_id":33132,"primary_group_id":47,"flair_group_id":47},{"extras":null,"description":"Frequent Poster","user_id":124916,"primary_group_id":null,"flair_group_id":null},{"extras":null,"description":"Frequent Poster","user_id":24924,"primary_group_id":null,"flair_group_id":48},{"extras":null,"description":"Frequent Poster","user_id":116883,"primary_group_id":null,"flair_group_id":48},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Authenticated Remote Code Execution via Path Traversal in FreePBX Backup Module","id":109724,"title":"Authenticated Remote Code Execution via Path Traversal in FreePBX Backup Module","slug":"authenticated-remote-code-execution-via-path-traversal-in-freepbx-backup-module","posts_count":2,"reply_count":0,"highest_post_number":2,"image_url":null,"created_at":"2026-06-12T19:25:52.023Z","last_posted_at":"2026-07-12T19:25:57.645Z","bumped":true,"bumped_at":"2026-06-12T19:25:52.430Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"tags":[{"id":115,"name":"v17","slug":"v17"},{"id":118,"name":"v16","slug":"v16"},{"id":114,"name":"security","slug":"security"},{"id":128,"name":"backup-restore","slug":"backup-restore"}],"tags_descriptions":{},"views":73,"like_count":0,"has_summary":false,"last_poster_username":"system","category_id":55,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":null,"description":"Original Poster","user_id":33132,"primary_group_id":47,"flair_group_id":47},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Authenticated Remote Code Execution via File Upload and Convert in Soundlang Module","id":109723,"title":"Authenticated Remote Code Execution via File Upload and Convert in Soundlang Module","slug":"authenticated-remote-code-execution-via-file-upload-and-convert-in-soundlang-module","posts_count":2,"reply_count":0,"highest_post_number":2,"image_url":null,"created_at":"2026-06-12T19:18:50.167Z","last_posted_at":"2026-07-12T19:19:00.698Z","bumped":true,"bumped_at":"2026-06-12T19:18:50.482Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"tags":[{"id":115,"name":"v17","slug":"v17"},{"id":17,"name":"modules","slug":"modules"},{"id":118,"name":"v16","slug":"v16"},{"id":114,"name":"security","slug":"security"}],"tags_descriptions":{},"views":57,"like_count":0,"has_summary":false,"last_poster_username":"system","category_id":55,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":null,"description":"Original Poster","user_id":33132,"primary_group_id":47,"flair_group_id":47},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Authenticated Command Injection in FreePBX UCP Interface","id":109721,"title":"Authenticated Command Injection in FreePBX UCP Interface","slug":"authenticated-command-injection-in-freepbx-ucp-interface","posts_count":2,"reply_count":0,"highest_post_number":2,"image_url":null,"created_at":"2026-06-12T17:28:39.835Z","last_posted_at":"2026-07-12T17:29:18.994Z","bumped":true,"bumped_at":"2026-06-12T17:28:40.052Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"tags":[{"id":115,"name":"v17","slug":"v17"},{"id":44,"name":"ucp","slug":"ucp"},{"id":118,"name":"v16","slug":"v16"},{"id":114,"name":"security","slug":"security"}],"tags_descriptions":{},"views":87,"like_count":0,"has_summary":false,"last_poster_username":"system","category_id":55,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":null,"description":"Original Poster","user_id":33132,"primary_group_id":47,"flair_group_id":47},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]},{"fancy_title":"Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion)","id":109720,"title":"Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion)","slug":"authenticated-superfecta-arbitrary-php-code-execution-rce-via-unsafe-file-inclusion","posts_count":2,"reply_count":0,"highest_post_number":2,"image_url":null,"created_at":"2026-06-12T17:19:30.418Z","last_posted_at":"2026-07-12T17:20:15.199Z","bumped":true,"bumped_at":"2026-06-12T17:19:30.742Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":true,"archived":false,"bookmarked":null,"liked":null,"tags":[{"id":115,"name":"v17","slug":"v17"},{"id":118,"name":"v16","slug":"v16"},{"id":114,"name":"security","slug":"security"},{"id":72,"name":"superfecta","slug":"superfecta"}],"tags_descriptions":{},"views":61,"like_count":0,"has_summary":false,"last_poster_username":"system","category_id":55,"op_like_count":0,"pinned_globally":false,"featured_link":null,"has_accepted_answer":false,"can_vote":false,"posters":[{"extras":null,"description":"Original Poster","user_id":33132,"primary_group_id":47,"flair_group_id":47},{"extras":"latest","description":"Most Recent Poster","user_id":-1,"primary_group_id":null,"flair_group_id":null}]}]}}