PT-2026-23491 · Freepbx · Freepbx

Xxkarazxx · Publicado 2026-03-05 · Atualizado 2026-03-08 · CVE-2026-28284

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreePBX versions prior to 16.0.10 FreePBX versions prior to 17.0.5

Description FreePBX logfiles module contains several authenticated SQL injection vulnerabilities. These issues allow an attacker with valid credentials to potentially manipulate database queries.

Recommendations Update to FreePBX version 16.0.10 or later. Update to FreePBX version 17.0.5 or later.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-28284

GHSA-4887-4JWP-327G

Produtos afetados

Freepbx

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28284.json · Exploit
• https://github.com/FreePBX/security-reporting/security/advisories/GHSA-4887-4jwp-327g · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-28284 · Nota de Segurança
• https://twitter.com/TheHackerWire/status/2030629593649197154 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-28284 · Aviso do Fabricante
• https://t.me/CVEtracker/46476 · Publicação no Telegram
• https://t.me/cveNotify/154519 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2029766393265029344 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2029654714959208645 · Publicação no Twitter