{"id":"CVE-2025-57819","aliases":["GHSA-m42g-xg4c-5f3h"],"url":"https://o3.security/vulnerability/CVE-2025-57819","summary":"FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE","details":"FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.","published":"2025-08-28T16:45:18.749Z","modified":"2026-10-24T10:30:50.202570340Z","cvss":null,"epss":{"score":0.85463,"percentile":0.99709,"asOf":"2026-09-16"},"cisaKev":{"dateAdded":"2025-08-29","dueDate":"2025-09-19","knownRansomwareCampaignUse":false},"exploitsKnown":8,"affectedPackages":[],"fix":null,"references":[{"type":"WEB","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-57819"},{"type":"ADVISORY","url":"https://community.freepbx.org/t/security-advisory-please-lock-down-your-administrator-access/107203"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57819.json"},{"type":"ADVISORY","url":"https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-57819"},{"type":"EVIDENCE","url":"https://github.com/watchtowrlabs/watchTowr-vs-FreePBX-CVE-2025-57819"}],"provenance":{"sources":["OSV.dev","CISA KEV","FIRST.org (EPSS)"],"lastVerified":"2026-10-24T10:30:50.202570340Z"}}