VulnSocial

CVE-2026-28210Disclosure(sangoma / freepbx)

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch sangoma freepbx systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

FreePBX is an open source IP PBX. Prior to versions 16.0.49 and 17.0.7, FreePBX module cdr (Call Data Record) is vulnerable to SQL query injection. This issue has been patched in versions 16.0.49 and 17.0.7.

sangoma CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • freepbx

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • Peaked 2d ago at 1 mentions (2026-03-05); latest day: 1
  • 3 total mentions across 3 days

Affected systems

Vendors
sangoma
Products
freepbx

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-03-05: 1Mentions · 2026-03-06: 1Mentions · 2026-03-08: 1Patch / Workaround · 2026-03-08: 1Technical Details · 2026-03-05: 1Technical Details · 2026-03-06: 1Technical Details · 2026-03-08: 103-0503-0603-08
Signal classification2 categories
Disclosure
266.7%
Patch
133.3%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-03-051
Disclosure1
2026-03-061
Disclosure1
2026-03-081
Patch1
Full discourse3 posts
  • The Hacker Wire@TheHackerWire
    Patch

    🟠 CVE-2026-28210 - High FreePBX is an open source IP PBX. Prior to versions 16.0.49 and 17.0.7, FreePBX module cdr (Call Data Record) is vulnerable to SQL query injection. This issue has been patched in versions 16.... https://www.thehackerwire.com/vulnerability/CVE-2026-28210/ https://t.co/KN0CiEX4EF

    Post summary

    FreePBX module cdr has a high‑severity SQL injection flaw, now patched in versions 16.0.49 and 17.0.7; no evidence of exploitation or PoC is presented.

    0000043
    130 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-28210 SQL Injection Vulnerability in FreePBX CDR Module Before ... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28210 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2

    Post summary

    A SQL injection vulnerability in the FreePBX CDR Module (CVE-2026-28210) has been disclosed, with basic details linked on Vulmon, but no PoC, exploit code, or patch information is provided.

    0000053
    4.0K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-28210 FreePBX is an open source IP PBX. Prior to versions 16.0.49 and 17.0.7, FreePBX module cdr (Call Data Record) is vulnerable to SQL query injection. This issue has bee… https://www.cve.org/CVERecord?id=CVE-2026-28210

    Post summary

    The post announces the disclosure of an SQL injection vulnerability in the FreePBX cdr module affecting versions 16.0.49 and 17.0.7.

    00000104
    56.6K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appsangomafreepbx---

Explore more

Back to dashboardsangoma CVEsfreepbx vulnerabilities