CVE-2026-44238
FreePBX: Authenticated SQL Injection via ORDER BY in CDR Reports
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
FreePBX is an open source IP PBX. Prior to 16.0.50 and 17.0.11, the CDR Reports module page allows SQL injection through the order and sort POST parameters. Authentication with a FreePBX Administration Control Panel account that has CDR section access is required. Full administrator privileges are not needed. This vulnerability is fixed in 16.0.50 and 17.0.11.
| CWE | CWE-89 |
| Vendor | freepbx |
| Product | security-reporting |
| Published | May 29, 2026 |
| Last Updated | May 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for freepbx security-reporting
Be the first to know when new unknown vulnerabilities affecting freepbx security-reporting are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
FreePBX / security-reporting
< 16.0.50 >= 17.0.1, < 17.0.11