{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3akobikomkobipbx/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:kobikom:kobipbx:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-105321"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["KobiPBX-FOP3-SEC (\u003c r1)"],"_cs_severities":["high"],"_cs_tags":["sqli","vulnerability","webserver"],"_cs_type":"advisory","_cs_vendors":["Kobikom"],"content_html":"\u003cp\u003eKobikom Telecommunications and Informatics Services Inc. has disclosed an improper neutralization of special elements used in an SQL command (SQL injection) vulnerability within its KobiPBX product. The flaw exists in versions prior to KobiPBX-FOP3-SEC-r1. Exploitation could allow an attacker to perform unauthorized database actions, such as data retrieval or modification.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthorized interaction with the backend database. While specific impact is not documented, SQL injection typically permits data exfiltration, database manipulation, or authentication bypass.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all instances of Kobikom KobiPBX within the network to identify versions below KobiPBX-FOP3-SEC-r1.\u003c/li\u003e\n\u003cli\u003eUpgrade all affected KobiPBX installations to the secure release (KobiPBX-FOP3-SEC-r1) or newer immediately.\u003c/li\u003e\n\u003cli\u003eUntil patching is complete, restrict access to the web management interface of KobiPBX to authorized internal management networks only.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-05T14:41:01Z","date_published":"2026-11-05T14:41:01Z","id":"https://feed.craftedsignal.io/briefs/2026-11-kobikom-sqli/","summary":"An SQL injection vulnerability exists in Kobikom KobiPBX versions prior to r1, allowing attackers to inject arbitrary SQL commands into the backend database.","title":"Kobikom KobiPBX: SQL injection vulnerability (CVE-2026-105321)","url":"https://feed.craftedsignal.io/briefs/2026-11-kobikom-sqli/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:kobikom:kobipbx:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}