Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
FreePBX-Vulns-December-25 — Detection for CVE-2025-61675, CVE-2025-61678 & CVE-2025-66039 | Kitploit
Tools/GitHubGitHub/rxerium/freepbx-vulns-december-25
Vulnerability ScannersWeb Vulnerability ScannersVulnerability AnalysisExploitationWeb SecurityPenetration Testing
GitHubrxerium/freepbx-vulns-december-25

FreePBX-Vulns-December-25

Detection for CVE-2025-61675, CVE-2025-61678 & CVE-2025-66039

View Repository
48748 months agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Locked FreePBX Vulnerabilities - December 2025

This repository contains Nuclei templates for detecting three critical vulnerabilities in FreePBX:

  • CVE-2025-61675: Authenticated SQL Injection (CVSS 8.6) - Affects endpoint module
  • CVE-2025-61678: Authenticated Arbitrary File Upload (CVSS 8.6) - Affects endpoint module
  • CVE-2025-66039: Authentication Bypass (CVSS 9.3) - Affects framework module

Package Affected Versions

CVE-2025-61675 & CVE-2025-61678 (endpoint module)

  • FreePBX 16: < 16.0.92 (patched in 16.0.92)
  • FreePBX 17: < 17.0.6 (patched in 17.0.6)

CVE-2025-66039 (framework module)

  • FreePBX 16: < 16.0.44 (patched in 16.0.44)
  • FreePBX 17: < 17.0.23 (patched in 17.0.23)

Search How does this detection method work?

These templates detect vulnerable FreePBX instances by:

  1. Extracting the FreePBX version from the administration panel
  2. Comparing the version against known vulnerable version ranges
  3. Confirming the presence of FreePBX-specific identifiers

The detection is non-invasive and does not attempt to exploit the vulnerabilities.

Rocket How do I run this script?

  1. Download and install Nuclei.
  2. Clone this repository to your local system.
  3. Run a single template:
root@kitploit:~
nuclei -u <target-url> -t CVE-2025-61675.yaml
  1. Run all templates:
root@kitploit:~
nuclei -u <target-url> -t .
  1. Scan multiple hosts:
root@kitploit:~
nuclei -l hosts.txt -t .

Example Output

root@kitploit:~
[CVE-2025-61675] [http] [high] FreePBX Authenticated SQL Injection
[CVE-2025-61678] [http] [high] FreePBX Authenticated Arbitrary File Upload
[CVE-2025-66039] [http] [critical] FreePBX Authentication Bypass

Books References

  • CVE-2025-61675 - NVD
  • CVE-2025-61678 - NVD
  • CVE-2025-66039 - NVD
  • Nuclei - ProjectDiscovery

Warning Disclaimer

Use at your own risk, I will not be responsible for illegal activities you conduct on infrastructure you do not own or have permission to scan.

License License

This project is licensed under the MIT License.

Contact Contact

If you have any questions about this vulnerability detection script please reach out to me via Signal.

If you would like to connect, I am mostly active on Twitter/X and LinkedIn.

Download Tool