PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

The FreePBX Rabbit Hole: CVE-2025-66039 and others

horizon3.ai | vulnerability | CVE-2025-66039 | #rce | #vulnerability-research | #sql-injection | #auth-bypass
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Horizon3 uncovers FreePBX flaws, including CVE-2025-66039 auth bypass, SQL injection, and file upload RCE—and shows how NodeZero detects them.
CVE
CVE-2025-66039
Published
Collected

Related coverage

vulnerability · horizon3.ai
[CVE-2021-41765] Multiple Vulnerabilities in ResourceSpace
Advisory for CVE-2021-41765, a critical SQL injection vulnerability leading to remote code execution, by the Horizon3 red team.
vulnerability · horizon3.ai
CVE-2020-35700: Exploiting a Second-Order SQL Injection in LibreNMS < 21.1.0
# CVE-2020-35700: Exploiting a Second-Order SQL Injection in LibreNMS * * * ##### How can NodeZero help you? Let our experts walk you through a demonstration of NodeZero®, so you can see how to...
vulnerability · horizon3.ai
CVE-2020-29437: Authenticated SQL Injection in OrangeHRM < 4.6.0.1
OrangeHRM is software for Human Resource Management (HRM). In a routine audit of the open source version of OrangeHRM, we discovered a SQL injection…
vulnerability · vercel.com
Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers
How Vercel and Hacktron coordinated a fix for a remote code execution vulnerability that reached Next.js image optimization through sharp, libvips, and libheif.
vulnerability · vercel.com
Postmortem on Next.js Middleware bypass
Last week, we published CVE-2025-29927 and patched a critical severity vulnerability in Next.js. Here’s our post-incident analysis and next steps.
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
Back