Sangoma Technologies Inc. FreePBX

Name: Sangoma Technologies Inc. FreePBX
Brand: Sangoma Technologies Inc.

productRU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

5critical4high0medium0low

updated 2026-10-27

vulnerabilities (9)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2025-57819US	critical9.8OT critical	95.0% (100th)	KEV	no fix	2025-08-28	—
CVE-2025-64328US	high7.2OT critical	84.6% (100th)	KEV	no fix	2025-11-07	17.0.2.36 → 17.0.3
CVE-2019-19006US	critical9.8OT critical	55.9% (99th)	KEV	no fix	2019-11-21	3 versions
CVE-2025-66039US	critical9.8	3.39% (89th)	Exploit	no fix	2025-12-09	2 versions
CVE-2021-45461US	critical9.8	21.5% (98th)	—	no fix	2021-12-22	2 versions
CVE-2020-36630US	critical9.8	0.74% (54th)	—	no fix	2022-12-25	14.0 → 14.0.5.21
CVE-2025-59056US	high7.5	0.46% (40th)	—	no fix	2025-09-15	3 versions
CVE-2025-55211US	high8.8	0.44% (38th)	—	no fix	2025-09-15	17.0.19.11 → 17.0.21
CVE-2025-55210US	high7.5	0.34% (28th)	—	no fix	2026-02-12	2 versions

The flaw types (CWEs) most of these CVEs share.

CWE-287Improper Authentication2 CVEs
CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')2 CVEs
CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')2 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1 CVEs
CWE-270Privilege Context Switching Error1 CVEs
CWE-288Authentication Bypass Using an Alternate Path or Channel1 CVEs
CWE-94Improper Control of Generation of Code ('Code Injection')1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.