CPE
critical
advisory
FreePBX Endpoint Manager Unauthenticated Remote Code Execution
1 rule 3 TTPs 1 CVEAn unauthenticated SQL injection vulnerability (CVE-2025-57819) in the FreePBX Endpoint Manager module allows attackers to achieve remote code execution by injecting malicious cron jobs.
FreePBX
webapps
cve
rce
sql-injection
exploit
1r
3t
1c
medium
advisory
FreePBX Hardcoded Credentials Vulnerability (CVE-2026-46376)
2 rules 1 TTP 1 CVEA critical vulnerability, CVE-2026-46376, exists in FreePBX due to the use of hard-coded credentials in the User Control Panel (UCP) generic template setup process, allowing an unauthenticated, remote attacker to gain unauthorized access to user accounts and manipulate user settings if default template credentials are not immediately changed by the administrator after enabling UCP.
FreePBX
cve
voip
credential-access
2r
1t
1c