PT-2026-23490 · Freepbx · Freepbx

Quirmz · Published 2026-03-05 · Updated 2026-03-08 · CVE-2026-28210

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreePBX versions prior to 16.0.49 FreePBX versions prior to 17.0.7

Description FreePBX module cdr (Call Data Record) is susceptible to SQL query injection. The issue allows for potential manipulation of database queries through crafted input.

Recommendations Update to FreePBX version 16.0.49 or later. Update to FreePBX version 17.0.7 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-28210

GHSA-59GP-632H-C54V

Affected Products

Freepbx

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28210.json · Exploit
• https://github.com/FreePBX/security-reporting/security/advisories/GHSA-59gp-632h-c54v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28210 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28210 · Vendor Advisory
• https://t.me/CVEtracker/46475 · Telegram Post
• https://twitter.com/TheHackerWire/status/2030629545792131473 · Twitter Post
• https://twitter.com/CVEnew/status/2029654715919724967 · Twitter Post
• https://t.me/cveNotify/154518 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2029761273710219540 · Twitter Post