CVE-2025-57819
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.
- Record
CVE-2025-57819- CVSS 4.0
- 10.0 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Weakness
- CWE-89, CWE-288
- Updated
- 2026-11-02
EUVDEUVD-2025-26123
FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.
- Record
EUVD-2025-26123- CVSS 4.0
- 10.0 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Updated
- 2026-11-02
CISA KEV No score
Sangoma FreePBX Authentication Bypass Vulnerability
Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution.
- Record
CVE-2025-57819- Weakness
- CWE-89, CWE-288
- Updated
- 2026-11-02
NVD
FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.
- Record
CVE-2025-57819- CVSS 4.0
- 10.0 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89, CWE-288
- Updated
- 2026-11-02
OSV
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.
- Record
CVE-2025-57819- CVSS 4.0
- 10.0 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Weakness
- CWE-288, CWE-89
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | FreePBX ajax.php unauthenticated SQLi to RCE | 2025-08-28 |
| PoC in GitHub | rxerium/CVE-2025-57819 | 2025-08-28 |
| PoC in GitHub | Sucuri-Labs/CVE-2025-57819-ioc-check | 2025-08-29 |
| PoC in GitHub | cybertechajju/cve-2025-57819 | 2025-08-30 |
| PoC in GitHub | blueisbeautiful/CVE-2025-57819 | 2025-09-01 |
| PoC in GitHub | ImBIOS/lab-cve-2025-57819 | 2025-09-04 |
| PoC in GitHub | watchtowrlabs/watchTowr-vs-FreePBX-CVE-2025-57819 | 2025-09-08 |
| PoC in GitHub | MuhammadWaseem29/SQL-Injection-and-RCE_CVE-2025-57819 | 2025-09-12 |
| PoC in GitHub | xV4nd3Rx/CVE-2025-57819_FreePBX-PoC | 2025-09-14 |
| PoC in GitHub | orange0Mint/CVE-2025-57819_FreePBX | 2025-09-18 |
Show 18 moreShow less
Plus 1 more. The full list has every link.
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation | ||
| exploits, exploits_more | ||
| exploits | ||
| first indexed | CVE List, EUVD, Exploit-DB, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-57819 is a critical vulnerability (CVSS 10.0) in Elastic Endpoint, published August 28, 2025. CISA lists it as known to be exploited, since August 29, 2025. EUVD reports exploitation since August 29, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 95.2%, the 99th percentile. No source names a fixed version.
References
github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h
community.freepbx.org/t/security-advisory-please-lock-down-your-administrator-access/107203
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-57819
nvd.nist.gov/vuln/detail/CVE-2025-57819