Unrated severityNVD Advisory· Published Mar 5, 2026· Updated Mar 7, 2026

FreePBX: Authenticated SQL Injection in CDR (Call Data Record) Reports

CVE-2026-28210

Description

FreePBX is an open source IP PBX. Prior to versions 16.0.49 and 17.0.7, FreePBX module cdr (Call Data Record) is vulnerable to SQL query injection. This issue has been patched in versions 16.0.49 and 17.0.7.

Affected products

Freepbx/cdrllm-create
Range: <16.0.49, <17.0.7
Freepbx/Freepbxllm-fuzzy
Range: <16.0.49, <17.0.7
FreePBX/security-reportingv5
Range: < 16.0.49

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/FreePBX/security-reporting/security/advisories/GHSA-59gp-632h-c54vmitrex_refsource_CONFIRM

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000