What is the CVSS score of CVE-2026-28284?

CVE-2026-28284 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Freepbx are affected by CVE-2026-28284?

FreePBX instances running versions prior to 16.0.10 or 17.0.5 contain authenticated SQL injection vulnerabilities in the logfiles module that could allow attackers with valid credentials to extract…

How to fix or mitigate CVE-2026-28284?

Within 24 hours: Inventory all FreePBX deployments and identify those running vulnerable versions (prior to 16.0.10 or 17.0.5); restrict logfiles module access to essential administrative personnel only. Within 7 days: Implement network segmentation to limit FreePBX administrative access to trusted networks; enable enhanced logging and monitoring of database queries; review recent logfiles module access logs for suspicious activity. Within 30 days: Upgrade FreePBX to patched versions 16.0.10 or 17.0.5 or later; conduct a security audit of database access logs to detect potential exploitation.

Freepbx CVE-2026-28284

HIGH

SQL Injection (CWE-89)

2026-03-05 security-advisories@github.com

SQLi Freepbx

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 19:16 nvd

HIGH 8.8

DescriptionGitHub Advisory

FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, the FreePBX logfiles module contains several authenticated SQL injection vulnerabilities. This issue has been patched in versions 16.0.10 and 17.0.5.

AnalysisAI

SQL injection in the FreePBX logfiles module allows authenticated attackers to manipulate database queries and potentially extract sensitive data or modify system records. Versions prior to 16.0.10 and 17.0.5 are vulnerable, and attackers with valid FreePBX credentials can exploit this weakness to achieve high-impact unauthorized access to confidential information and system integrity. No patch is currently available for affected deployments.

Technical ContextAI

Classified as CWE-89 (SQL Injection). Affects Freepbx. FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, the FreePBX logfiles module contains several authenticated SQL injection vulnerabilities. This issue has been patched in versions 16.0.10 and 17.0.5.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.