CVE-2025-55209

contactmanager is a module for FreePBX@, which is an open source GUI that controls and manages Asterisk© (PBX). In versions 15.0.14 and below, 16.0.0 through 16.0.26.4 and 17.0.0 through 17.0.5, a stored cross-site scripting (XSS) vulnerability in FreePBX allows a low-privileged User Control Panel (UCP) user to inject malicious JavaScript into the system. The malicious code executes in the context of an administrator when they interact with the affected component, leading to session hijacking and potential privilege escalation. This issue is fixed in versions 15.0.14, 16.0.27 and 17.0.6.

• CWE-79

• https://github.com/FreePBX/contactmanager/commit/55abba0f1ab5d66ba87732fd06179231d1f68184
• https://github.com/FreePBX/security-reporting/security/advisories/GHSA-j654-x3q2-6wm3

Published

Sep 4, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-55202Opencast is a free, open-source platform to support the mana…5.3
• CVE-2025-55203Plane is open-source project management software. Prior to v…5.4
• CVE-2025-55204muffon is a cross-platform music streaming client for deskto…9.6
• CVE-2025-55205Capsule is a multi-tenancy and policy-based framework for Ku…9
• CVE-2025-55207Astro is a web framework for content-driven websites. Follow…5.5
• CVE-2025-55208Chamilo is a learning management system. Versions prior to 1…9
• CVE-2025-5521A vulnerability was found in WuKongOpenSource WukongCRM 9.0.…8.8
• CVE-2025-55210FreePBX is an open-source web-based graphical user interface…7.5
• CVE-2025-55211FreePBX is an open-source web-based graphical user interface…8.8
• CVE-2025-55212ImageMagick is free and open-source software used for editin…7.5
• CVE-2025-55213OpenFGA is a high-performance and flexible authorization/per…9.8
• CVE-2025-55214Copier library and CLI app for rendering project templates. …6.9