# Sangoma Freepbx


- [CVE-2025-57819](https://insights.sbomify.com/CVE-2025-57819/): Sangoma FreePBX Authentication Bypass (critical 10.0, exploited in the wild)
- [CVE-2019-19006](https://insights.sbomify.com/CVE-2019-19006/): Sangoma FreePBX Improper Authentication (critical 9.8, exploited in the wild)
- [CVE-2014-7235](https://insights.sbomify.com/CVE-2014-7235/): Deserialization in n/a (critical 10.0)
- [CVE-2026-73663](https://insights.sbomify.com/CVE-2026-73663/): FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover (critical 9.3)
- [CVE-2026-73665](https://insights.sbomify.com/CVE-2026-73665/): FreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injection (critical 9.3)
- [CVE-2026-46376](https://insights.sbomify.com/CVE-2026-46376/): FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface (critical 9.3)
- [CVE-2025-66039](https://insights.sbomify.com/CVE-2025-66039/): FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header (critical 9.3)
- [CVE-2023-43336](https://insights.sbomify.com/CVE-2023-43336/): Missing authorization in n/a (high 8.8)
- [CVE-2026-54675](https://insights.sbomify.com/CVE-2026-54675/): FreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang Module (high 8.7)
- [CVE-2024-58294](https://insights.sbomify.com/CVE-2024-58294/): FreePBX 16 Authenticated Remote Code Execution via API Module (high 8.7)
- [CVE-2026-54674](https://insights.sbomify.com/CVE-2026-54674/): Authenticated Command Injection in FreePBX UCP Interface (high 8.6)
- [CVE-2026-54708](https://insights.sbomify.com/CVE-2026-54708/): Authenticated Remote Code Execution via Path Traversal in FreePBX Backup Module (high 8.6)

---
From sbomify Insights: https://insights.sbomify.com/products/sangoma/freepbx/