{"id":"CVE-2025-57819","aliases":["EUVD-2025-26123","GHSA-m42g-xg4c-5f3h"],"status":"published","title":"FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE","description":"FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.","severity":{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.95213,"percentile":0.99866,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-288","CWE-89"],"published":"2025-08-28T16:45:18Z","modified":"2026-10-28T02:30:49Z","kev":{"date_added":"2025-08-29","due_date":"2025-09-19","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2025-08-29"},{"source":"kev","since":"2025-08-29"}],"exploits":[{"source":"metasploit","id":"exploit/unix/http/freepbx_unauth_sqli_to_rce","title":"FreePBX ajax.php unauthenticated SQLi to RCE","type":"exploit","platform":"Linux","date":"2025-08-28","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/unix/http/freepbx_unauth_sqli_to_rce"},{"source":"pocgithub","id":"rxerium/CVE-2025-57819","title":"rxerium/CVE-2025-57819","date":"2025-08-28","url":"https://github.com/rxerium/CVE-2025-57819"},{"source":"pocgithub","id":"Sucuri-Labs/CVE-2025-57819-ioc-check","title":"Sucuri-Labs/CVE-2025-57819-ioc-check","date":"2025-08-29","url":"https://github.com/Sucuri-Labs/CVE-2025-57819-ioc-check"},{"source":"pocgithub","id":"cybertechajju/cve-2025-57819","title":"cybertechajju/cve-2025-57819","date":"2025-08-30","url":"https://github.com/cybertechajju/cve-2025-57819"},{"source":"pocgithub","id":"blueisbeautiful/CVE-2025-57819","title":"blueisbeautiful/CVE-2025-57819","date":"2025-09-01","url":"https://github.com/blueisbeautiful/CVE-2025-57819"},{"source":"pocgithub","id":"ImBIOS/lab-cve-2025-57819","title":"ImBIOS/lab-cve-2025-57819","date":"2025-09-04","url":"https://github.com/ImBIOS/lab-cve-2025-57819"},{"source":"pocgithub","id":"watchtowrlabs/watchTowr-vs-FreePBX-CVE-2025-57819","title":"watchtowrlabs/watchTowr-vs-FreePBX-CVE-2025-57819","date":"2025-09-08","url":"https://github.com/watchtowrlabs/watchTowr-vs-FreePBX-CVE-2025-57819"},{"source":"pocgithub","id":"MuhammadWaseem29/SQL-Injection-and-RCE_CVE-2025-57819","title":"MuhammadWaseem29/SQL-Injection-and-RCE_CVE-2025-57819","date":"2025-09-12","url":"https://github.com/MuhammadWaseem29/SQL-Injection-and-RCE_CVE-2025-57819"},{"source":"pocgithub","id":"xV4nd3Rx/CVE-2025-57819_FreePBX-PoC","title":"xV4nd3Rx/CVE-2025-57819_FreePBX-PoC","date":"2025-09-14","url":"https://github.com/xV4nd3Rx/CVE-2025-57819_FreePBX-PoC"},{"source":"pocgithub","id":"orange0Mint/CVE-2025-57819_FreePBX","title":"orange0Mint/CVE-2025-57819_FreePBX","date":"2025-09-18","url":"https://github.com/orange0Mint/CVE-2025-57819_FreePBX"},{"source":"pocgithub","id":"0xEhab/FreePBX-CVE-2025-57819-RCE","title":"0xEhab/FreePBX-CVE-2025-57819-RCE","date":"2026-06-06","url":"https://github.com/0xEhab/FreePBX-CVE-2025-57819-RCE"},{"source":"pocgithub","id":"b4sh2/CVE-2025-57819-poc","title":"b4sh2/CVE-2025-57819-poc","date":"2026-06-06","url":"https://github.com/b4sh2/CVE-2025-57819-poc"},{"source":"pocgithub","id":"Jeanback1/CVE-2025-57819-exploit","title":"Jeanback1/CVE-2025-57819-exploit","date":"2026-06-07","url":"https://github.com/Jeanback1/CVE-2025-57819-exploit"},{"source":"pocgithub","id":"jf-gondim/freepbx-endpoint-sqli-rce","title":"jf-gondim/freepbx-endpoint-sqli-rce","date":"2026-06-07","url":"https://github.com/jf-gondim/freepbx-endpoint-sqli-rce"},{"source":"pocgithub","id":"YuvrajSHAD/FreePBX-CVE-2025-57819","title":"YuvrajSHAD/FreePBX-CVE-2025-57819","date":"2026-06-08","url":"https://github.com/YuvrajSHAD/FreePBX-CVE-2025-57819"},{"source":"pocgithub","id":"0xyngtg/FreePBX-CVE-2025-57819-CVE-2025-61678","title":"0xyngtg/FreePBX-CVE-2025-57819-CVE-2025-61678","date":"2026-06-12","url":"https://github.com/0xyngtg/FreePBX-CVE-2025-57819-CVE-2025-61678"},{"source":"pocgithub","id":"ozcanpng/CVE-2025-57819-FreePBX-RCE2Root","title":"ozcanpng/CVE-2025-57819-FreePBX-RCE2Root","date":"2026-06-18","url":"https://github.com/ozcanpng/CVE-2025-57819-FreePBX-RCE2Root"},{"source":"pocgithub","id":"HexBytee/FreePBX-SQLi-RCE","title":"HexBytee/FreePBX-SQLi-RCE","date":"2026-06-24","url":"https://github.com/HexBytee/FreePBX-SQLi-RCE"},{"source":"pocgithub","id":"Its1Zero/cve-2025-57819-exploit","title":"Its1Zero/cve-2025-57819-exploit","date":"2026-07-01","url":"https://github.com/Its1Zero/cve-2025-57819-exploit"},{"source":"pocgithub","id":"Neobee714/CVE-2025-57819-POC","title":"Neobee714/CVE-2025-57819-POC","date":"2026-07-20","url":"https://github.com/Neobee714/CVE-2025-57819-POC"},{"source":"pocgithub","id":"TeteREN/CVE-2025-57819-RCE","title":"TeteREN/CVE-2025-57819-RCE","date":"2026-08-01","url":"https://github.com/TeteREN/CVE-2025-57819-RCE"},{"source":"exploitdb","id":"EDB-52681","title":"FreePBX  17.0.2 - Remote Code Execution (RCE)","type":"webapps","platform":"multiple","date":"2026-09-03","url":"https://www.exploit-db.com/exploits/52681"},{"source":"pocgithub","id":"r3vpwnx/CVE-2025-57819","title":"r3vpwnx/CVE-2025-57819","date":"2026-09-06","url":"https://github.com/r3vpwnx/CVE-2025-57819"},{"source":"pocgithub","id":"shivammittal2403/cve-2025-57819-freepbx-range","title":"shivammittal2403/cve-2025-57819-freepbx-range","date":"2026-09-17","url":"https://github.com/shivammittal2403/cve-2025-57819-freepbx-range"},{"source":"pocgithub","id":"donggle0802-code/cve-2025-57819","title":"donggle0802-code/cve-2025-57819","date":"2026-09-23","url":"https://github.com/donggle0802-code/cve-2025-57819"},{"source":"pocgithub","id":"kelltich-756/FreePBX-Breaker","title":"kelltich-756/FreePBX-Breaker","date":"2026-10-05","url":"https://github.com/kelltich-756/FreePBX-Breaker"},{"source":"pocgithub","id":"foxcornlab/freepbx-rce-detector","title":"foxcornlab/freepbx-rce-detector","date":"2026-10-08","url":"https://github.com/foxcornlab/freepbx-rce-detector"},{"source":"nuclei","id":"CVE-2025-57819","title":"FreePBX - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-57819.yaml"}],"exploits_more":1,"products":[{"vendor":"elastic","product":"endpoint"},{"vendor":"freepbx","product":"endpoint"},{"vendor":"sangoma","product":"freepbx"}],"references":[{"url":"https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","advisory"]},{"url":"https://community.freepbx.org/t/security-advisory-please-lock-down-your-administrator-access/107203","tags":["x_refsource_MISC","Issue Tracking","Vendor Advisory","advisory"]},{"url":"https://github.com/watchtowrlabs/watchTowr-vs-FreePBX-CVE-2025-57819","tags":["exploit","Exploit","Third Party Advisory","evidence"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-57819","tags":["government-resource","US Government Resource","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57819.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-57819","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-57819","title":"FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE","description":"FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.","status":"published","published":"2025-08-28T16:45:18.749Z","modified":"2026-02-26T17:47:51.014Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna"}],"cwes":["CWE-89","CWE-288"],"updated_at":"2026-11-02T14:32:35.099955Z"}],"euvd":[{"id":"EUVD-2025-26123","description":"FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.","status":"published","published":"2025-08-28T16:45:18Z","modified":"2026-02-26T17:47:51Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"exploited_since":"2025-08-29","updated_at":"2026-11-02T19:48:22.96585Z"}],"kev":[{"id":"CVE-2025-57819","title":"Sangoma FreePBX Authentication Bypass Vulnerability","description":"Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution.","cwes":["CWE-89","CWE-288"],"kev":{"date_added":"2025-08-29","due_date":"2025-09-19","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:15.999436Z"}],"nvd":[{"id":"CVE-2025-57819","description":"FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.","status":"published","published":"2025-08-28T17:15:36.79Z","modified":"2026-09-26T00:10:00.127Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-89","CWE-288"],"updated_at":"2026-11-02T14:11:25.826804Z"}],"osv":[{"id":"CVE-2025-57819","title":"FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE","description":"FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.","status":"published","published":"2025-08-28T16:45:18.749Z","modified":"2026-10-28T02:30:49.067321699Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"cwes":["CWE-288","CWE-89"],"updated_at":"2026-11-02T15:44:51.190588Z"}]}}