Skip to content
OpenAdvisories

Vendor

mwtcmi

5 known vulnerabilities.

Products

frogman 5
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-46515

    Frogman: Multiple read-tier tools expose admin-grade data and arbitrary GraphQL execution

    Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.3, PERM_READ access was sufficient to call fm_list_managers, fm_list_pinsets, fm_show_context, fm_get_mcp_config, fm_backup_status, fm_whos_calling, fm_run_saved_query, and fm_diagno…

    mwtcmi frogman
  • Critical 9.9
    CVE-2026-46512

    Frogman: Dialplan template parameters interpolated into extensions_custom.conf without escaping

    Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_dialplan_apply accepted template parameters including greeting, dest, url, extension, code, and file, and Tools/DialplanApply.php wrote Dialplan/Templates.php output to extensi…

    mwtcmi frogman