Most Exploited Internet-Facing Products

MEIFP

Back to Ranking

FreePBX

Products: FreePBX · core · endpoint · endpointman · filestore

64.6

Score

3

CVEs

2

Active

1

PoC

2

KEV

#45

Rank

Period:

Product:

CVE ID	Published	CVSS	Exploit	KEV	AC	PR	Auto	Score(hover)	Affected Products	Description
CVE-2024-58294	2025-12-11	8.7v4.0	POC	—	Low	Low	no	0.0	FreePBX	FreePBX 16 contains an authenticated remote code execution vulnerability in the API module that allows attackers with valid session credentials to execute arbitrary commands. Attackers can exploit the 'generatedocs' endpoint by crafting malicious POST requests with bash command injection to establis
CVE-2025-64328	2025-11-07	8.6v4.0	ACTIVE		Low	High	no	24.0	filestore	FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the filestore module within the Administrative interface is vulnerable to a post-authentication command injection by an authenticated known user via the testconnec
CVE-2025-57819	2025-08-28	10.0v4.0	ACTIVE		Low	None	YES	40.6	endpoint	FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue h

Each CVE: 10 pts base (Active only), boosted by:

KEV×2.0AC: Low×1.2PR: None×1.3PR: Low×1.1Auto×1.3