cve.bz

CVE-2025-57819

10.0 criticalKEVEPSS 95%

Critical (10.0) in Sangoma FreePBX. In CISA KEV since 2025-08-29. EPSS 95% chance of exploitation in the next 30 days.

FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.

Severity

CVSS 4.0

10.0 critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CVSS 3.1

9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
95% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CISA KEV
listed 2025-08-29, due 2025-09-19
CWEs
CWE-89, CWE-288
Published
Modified
Record from
the NVD, synced

Affected

References

Check your stackJSON