| Package | Affected versions | Patched versions |
|---|---|---|
| freepbx | = 16.0 |
FreePBX 16 contains an authenticated remote code execution vulnerability in the API module that allows attackers with valid session credentials to execute arbitrary commands. Attackers can exploit the 'generatedocs' endpoint by crafting malicious POST requests with bash command injection to establish remote shell access.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free