Vulnerability Intelligence Report
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
CVE-2025-57819
FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.
CISA KEV
Nuclei Template
SSVC: Active Exploitation
Automatable
CVSS Base Score
10.0
CRITICAL
EPSS Probability:93.29%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| FreePBX | endpoint | < 15.0.66 (affected), < 16.0.89 (affected), < 17.0.3 (affected) |
Threat Intelligence Signals
CISA KEV
ACTIVE IN CATALOG
Nuclei Template
SCANNER AVAILABLE
EPSS Score
93.286%
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | GitHub, Inc. · Vendor · USA |
| Reserved | 2025-08-20T14:30:35 |
| Published | 2025-08-28T16:45:18 |
| Last Updated | 2026-02-26T17:47:51 |
Community Chatter & Buzz