PT-2026-23491 · Freepbx · Freepbx

Xxkarazxx · Published 2026-03-05 · Updated 2026-03-08 · CVE-2026-28284

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreePBX versions prior to 16.0.10 FreePBX versions prior to 17.0.5

Description FreePBX logfiles module contains several authenticated SQL injection vulnerabilities. These issues allow an attacker with valid credentials to potentially manipulate database queries.

Recommendations Update to FreePBX version 16.0.10 or later. Update to FreePBX version 17.0.5 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-28284

GHSA-4887-4JWP-327G

Affected Products

Freepbx

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28284.json · Exploit
• https://github.com/FreePBX/security-reporting/security/advisories/GHSA-4887-4jwp-327g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28284 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28284 · Vendor Advisory
• https://twitter.com/TheHackerWire/status/2030629593649197154 · Twitter Post
• https://t.me/CVEtracker/46476 · Telegram Post
• https://t.me/cveNotify/154519 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2029766393265029344 · Twitter Post
• https://twitter.com/CVEnew/status/2029654714959208645 · Twitter Post