Nixpkgs security tracker

Login with GitHub

Suggestion detail

Dismissed

Permalink CVE-2025-57819

updated 5 months, 1 week ago by @LeSuisse Activity log

Created suggestion 5 months, 1 week ago
@LeSuisse ignored
11 packages
- rubyPackages.indieweb-endpoints
- rubyPackages_3_1.indieweb-endpoints
- rubyPackages_3_2.indieweb-endpoints
- rubyPackages_3_3.indieweb-endpoints
- rubyPackages_3_4.indieweb-endpoints
- rubyPackages_4_0.indieweb-endpoints
- python313Packages.alibabacloud-endpoint-util
- python314Packages.alibabacloud-endpoint-util
- python312Packages.azure-synapse-managedprivateendpoints
- python313Packages.azure-synapse-managedprivateendpoints
- python314Packages.azure-synapse-managedprivateendpoints
5 months, 1 week ago
@LeSuisse dismissed 5 months, 1 week ago

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.

References

https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h x_refsource_CONFIRM
https://community.freepbx.org/t/security-advisory-please-lock-down-your-administrator-access/107203 x_refsource_MISC
https://github.com/watchtowrlabs/watchTowr-vs-FreePBX-CVE-2025-57819 exploit
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025… government-resource

Affected products

endpoint

==< 17.0.3
==< 15.0.66
==< 16.0.89

security-reporting

==< 17.0.3
==< 15.0.66
==< 16.0.89

Ignored packages (11)

pkgs.rubyPackages.indieweb-endpoints

None

nixos-unstable -
- nixpkgs-unstable 8.0.0
- nixos-unstable-small 8.0.0

pkgs.rubyPackages_3_1.indieweb-endpoints

None

pkgs.rubyPackages_3_2.indieweb-endpoints

None

pkgs.rubyPackages_3_3.indieweb-endpoints

None

nixos-unstable 8.0.0
- nixpkgs-unstable 8.0.0
- nixos-unstable-small 8.0.0

pkgs.rubyPackages_3_4.indieweb-endpoints

None

nixos-unstable 8.0.0
- nixpkgs-unstable 8.0.0
- nixos-unstable-small 8.0.0

pkgs.rubyPackages_4_0.indieweb-endpoints

None

nixos-unstable 8.0.0
- nixpkgs-unstable 8.0.0
- nixos-unstable-small 8.0.0

pkgs.python313Packages.alibabacloud-endpoint-util

Endpoint-util module of alibabaCloud Python SDK

nixos-unstable 0.0.4
- nixpkgs-unstable 0.0.4
- nixos-unstable-small 0.0.4

pkgs.python314Packages.alibabacloud-endpoint-util

Endpoint-util module of alibabaCloud Python SDK

nixos-unstable 0.0.4
- nixpkgs-unstable 0.0.4
- nixos-unstable-small 0.0.4

pkgs.python312Packages.azure-synapse-managedprivateendpoints

None

pkgs.python313Packages.azure-synapse-managedprivateendpoints

Microsoft Azure Synapse Managed Private Endpoints Client Library

nixos-unstable 0.4.0
- nixpkgs-unstable 0.4.0
- nixos-unstable-small 0.4.0

pkgs.python314Packages.azure-synapse-managedprivateendpoints

Microsoft Azure Synapse Managed Private Endpoints Client Library

nixos-unstable 0.4.0
- nixpkgs-unstable 0.4.0
- nixos-unstable-small 0.4.0

Not present in nixpkgs