SQL injection in FreePBX missedcall module via inbound Caller ID name (CVE-2026-73663)

The FreePBX missedcall module inserts the inbound caller's name directly into a SQL INSERT statement in agi-bin/missedcallnotify.php without escaping or bound parameters. An unauthenticated remote attacker can craft a malicious SIP From header to inject arbitrary SQL when a monitored extension goes unanswered, resulting in database corruption, modification of FreePBX administrator accounts, and unauthorized remote access to the administrator control panel. Affected versions: - missedcall (FreePBX 16) < 16.0.11 - missedcall (FreePBX 17) < 17.0.6 We recommend updating to: 16.0.11 (FreePBX 16), 17.0.6 (FreePBX 17). CVSS 9.3 · our assessment: act_now Reference: https://github.com/FreePBX/security-reporting/security/advisories/GHSA-g27h-xf3q-h3rm Details: https://vuln.today/cve/CVE-2026-73663