Skip to content
OpenAdvisories

Product · mwtcmi

frogman

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.8
    CVE-2026-46516

    Frogman vulnerable to stored XSS in chat console formatter (escalation vector in multi-admin deployments)

    Frogman provides headless FreePBX control. Prior to version 1.6.6, Frogman's chat-console markdown formatter (`assets/js/chat.js`'s `formatMarkdown`) inserted regex capture groups as raw HTML in four template patterns: inline code, bold, markdown links, and d…

    mwtcmi frogman
  • Medium 6.5
    CVE-2026-46514

    Frogman: Plaintext passwords and secrets persisted to audit log

    Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_reset_password in Tools/ResetPassword.php:48-53 returned a plaintext password and fm_add_extension in Tools/AddExtension.php:172 returned a plaintext secret; Frogman.class.php:…

    mwtcmi frogman