Exploit-DB entry 52681 (dated 3 September 2026) documents a public remote-code-execution exploit for CVE-2025-57819 in FreePBX Endpoint Manager. The flaw is an unauthenticated SQL injection in the brand parameter of /admin/ajax.php that can insert a malicious cron_jobs row and yield a reverse shell as the web user.

Affected branches per the exploit write-up: FreePBX 15.x before 15.0.66, 16.x before 16.0.89, and 17.x before 17.0.3 (title tested against 17.0.2).

The write-up cites CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), CWE-89 and CWE-288, NVD, and GitHub advisory GHSA-m42g-xg4c-5f3h. Upgrade Endpoint Manager / FreePBX to the fixed releases; restrict admin/ajax exposure; hunt for unexpected cron_jobs entries.

Correction (25 Oct 2026): FreePBX's own advisory (GHSA-m42g-xg4c-5f3h, 28 August 2025) and the CVE record score CVE-2025-57819 at 10.0 Critical under CVSS 4.0; 9.8 is the score cited in the Exploit-DB write-up.

FreePBX also says that starting on or before 21 August 2025 an unauthorised user began accessing multiple FreePBX 16 and 17 systems connected directly to the internet by exploiting this flaw, and CISA added it to its Known Exploited Vulnerabilities catalog on 29 August 2025; the card had described only a public exploit. (source: FreePBX GHSA-m42g-xg4c-5f3h; CISA KEV catalog)