CVE-2025-30004

8.8 highEPSS 4.3%

High (8.8) in xorcom completepbx. EPSS 4.3% chance of exploitation in the next 30 days.

Xorcom CompletePBX is vulnerable to command injection in the administrator Task Scheduler functionality, allowing for attackers to execute arbitrary commands as the root user. This issue affects CompletePBX: all versions up to and prior to 5.2.35

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 4.3% chance of exploitation in the next 30 days; higher than 91% of CVEs (scores of 2026-10-31)
CWE: CWE-78
Published: 2025-03-31
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

xorcom:completepbx

References

https://vulncheck.com/advisories/completepbx-authenticated-command-injection
https://www.xorcom.com/new-completepbx-release-5-2-36-1/

Check your stack JSON