Skip to content
OpenAdvisories

Product · FreePBX

tts

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2026-73660

    FreePBX: Authenticated TTS AGI Command Injection Through TTS Name

    FreePBX is an open source IP PBX. Prior to 16.0.6 and 17.0.5.4, the FreePBX Text-To-Speech module allows an authenticated administrator to save a TTS destination name that is HTML-encoded for storage, decoded during dialplan generation, passed as an AGI argum…

    FreePBX tts
  • High 8.6
    CVE-2025-67736

    Authenticated SQL Injection in FreePBX tts (Text To Speech) module

    The FreePBX module tts (Text to Speech) for FreePBX, an open-source web-based graphical user interface (GUI) that manages Asterisk. Versions prior to 16.0.5 and 17.0.5 are vulnerable to SQL injection by authenticated users with administrator access. Authentic…

    FreePBX tts