What is CVE-2025-64328 in FreePBX?

FreePBX filestore command injection. Authenticated upload leads to OS command exec. Metasploit module auto-detects vulnerable versions.

How bad is AVideo Encoder CVE -2026-29058?

Unauthenticated command injection via getImage.php. No login needed. Remote code exec on Linux servers.

Yes. Two exploits, LDAP enhancement, crash fixes. msfupdate and go.

🕳️ Vulnerabilities & CVEs

Metasploit just armed hackers with easy command injection hits on FreePBX and AVideo Encoder. Think your PBX is secure? Think again.

CVE Watch Apr 11, 2026 3 min read

New Metasploit exploits target FreePBX (CVE-2025-64328) and AVideo Encoder (CVE-2026-29058) command injections. 𝕏
LDAP query enhancement skips SACL by default, aiding non-priv access. 𝕏
Seven bug fixes stabilize Framework, from crashes to interface binding. 𝕏

Published by

Threat intelligence. Zero noise.

#AVideo Encoder #AVideo Encoder CVE #AVideo Encoder RCE #CVE-2026-29058 #FreePBX #FreePBX exploit #Metasploit #Metasploit update

Get the best Cybersecurity stories of the week in your inbox — no noise, no spam.

Originally reported by Rapid7 Blog