CVE-2018-19911

FreeSWITCH through 1.8.2, when mod_xml_rpc is enabled, allows remote attackers to execute arbitrary commands via the api/system or txtapi/system (or api/bg_system or txtapi/bg_system) query string on TCP port 8080, as demonstrated by an api/system?calc URI. This can also be exploited via CSRF. Alternatively, the default password of works for the freeswitch account can sometimes be used.

• CWE-77
• CWE-352

• https://github.com/iSafeBlue/freeswitch_rce/blob/master/README-en.mdExploit, Third Party Advisory
• https://github.com/iSafeBlue/freeswitch_rce/blob/master/freeswitch_rce.pyExploit, Third Party Advisory
• https://github.com/iSafeBlue/freeswitch_rce/blob/master/README-en.mdExploit, Third Party Advisory
• https://github.com/iSafeBlue/freeswitch_rce/blob/master/freeswitch_rce.pyExploit, Third Party Advisory

Published

Dec 6, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-19904Persistent XSS exists in XSLT CMS via the create/?action=ite…6.1
• CVE-2018-19905HTML injection exists in razorCMS 3.4.8 via the /#/page keyw…5.4
• CVE-2018-19906Stored XSS exists in razorCMS 3.4.8 via the /#/page descript…5.4
• CVE-2018-19907A Server-Side Template Injection issue was discovered in Cra…
• CVE-2018-19908An issue was discovered in MISP 2.4.9x before 2.4.99. In app…
• CVE-2018-1991IBM API Connect 5.0.0.0, and 5.0.8.6 could could return sens…2.7
• CVE-2018-19913DomainMOD through 4.11.01 has XSS via the assets/add/registr…
• CVE-2018-19914DomainMOD through 4.11.01 has XSS via the assets/add/dns.php…
• CVE-2018-19915DomainMOD through 4.11.01 has XSS via the assets/edit/host.p…
• CVE-2018-19917Microweber 1.0.8 has reflected cross-site scripting (XSS) vu…
• CVE-2018-19918CuppaCMS has XSS via an SVG document uploaded to the adminis…5.4
• CVE-2018-19919Pixelimity 1.0 has Persistent XSS via the admin/portfolio.ph…