CVE-2026-28210 — FreePBX: Authenticated SQL Injection in CDR (Call Data Record) Reports

CVE-2026-28210

FreePBX: Authenticated SQL Injection in CDR (Call Data Record) Reports PUBLISHED

Description (CNA)

FreePBX is an open source IP PBX. Prior to versions 16.0.49 and 17.0.7, FreePBX module cdr (Call Data Record) is vulnerable to SQL query injection. This issue has been patched in versions 16.0.49 and 17.0.7.

Affected (CNA)

Vendor / product	Versions
FreePBX / security-reporting	affected < 16.0.49; affected < 17.0.7

CWE

CWE-89

References

https://github.com/FreePBX/security-reporting/security/advisories/GHSA-59gp-632h-c54v

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.