{"id":"CVE-2025-55209","summary":"FreePBX UCP is Vulnerable to Stored XSS Through its User Control Panel","details":"contactmanager is a module for FreePBX@, which is an open source GUI that controls and manages Asterisk© (PBX). In versions 15.0.14 and below, 16.0.0 through 16.0.26.4 and  17.0.0 through 17.0.5, a stored cross-site scripting (XSS) vulnerability in FreePBX allows a low-privileged User Control Panel (UCP) user to inject malicious JavaScript into the system. The malicious code executes in the context of an administrator when they interact with the affected component, leading to session hijacking and potential privilege escalation. This issue is fixed in versions 15.0.14, 16.0.27 and 17.0.6.","aliases":["GHSA-j654-x3q2-6wm3"],"modified":"2026-08-12T03:51:43.573496602Z","published":"2025-09-04T22:50:59.946Z","database_specific":{"cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55209.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55209.json"},{"type":"ADVISORY","url":"https://github.com/FreePBX/security-reporting/security/advisories/GHSA-j654-x3q2-6wm3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55209"},{"type":"FIX","url":"https://github.com/FreePBX/contactmanager/commit/55abba0f1ab5d66ba87732fd06179231d1f68184"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/freepbx/contactmanager","events":[{"introduced":"0"},{"fixed":"30bfae293a45e4c670687522d6d1bb4fadb443f1"},{"fixed":"2e9209c4b78c35bdc77dca3cbd53ba210e5cb687"},{"fixed":"e2f038e62b1bf9e56e468e97967c7f0e480d3b4c"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"15.0.14"},{"introduced":"16.0.0"},{"fixed":"16.0.27"},{"introduced":"17.0.0"},{"fixed":"17.0.6"}],"source":"AFFECTED_FIELD"}}],"versions":["release/17.0.5.17","release/16.0.26.4","release/17.0.5.16","release/16.0.26.3","release/17.0.5.15","release/17.0.5.14","release/17.0.5.13","release/17.0.5.12","release/16.0.26.2","release/17.0.5.11","release/16.0.26.1","release/17.0.5.10","release/17.0.5.9","release/17.0.5.8","release/15.0.13","release/17.0.5.7","release/16.0.26","release/15.0.10","release/17.0.5.6","release/16.0.25","release/17.0.5.5","release/17.0.5.4","release/17.0.5.3","release/17.0.5.2","release/17.0.5.1","release/15.0.12","release/16.0.24","release/17.0.5","release/17.0.4","release/16.0.23","release/15.0.9.10","release/17.0.3","release/17.0.2","release/17.0.1","release/16.0.22","release/15.0.11","release/16.0.21","release/16.0.20","release/16.0.19","release/16.0.18.19","release/15.0.9.13","release/16.0.18.18","release/15.0.9.12","release/16.0.18.17","release/15.0.9.11","release/16.0.18.16","release/16.0.18.15","release/16.0.18.14","release/15.0.9.9","release/16.0.18.13","release/15.0.9.8","release/16.0.18.12","release/15.0.9.7","release/15.0.9.6","release/16.0.18.11","release/16.0.18.10","release/16.0.18.9","release/16.0.18.8","release/16.0.18.7","release/16.0.18.6","release/16.0.18.5","release/15.0.9.5","release/16.0.18.4","release/15.0.9.4","release/16.0.18.3","release/15.0.9.3","release/15.0.9.1","release/16.0.18.2","release/15.0.9.2","release/16.0.18.1","release/16.0.18","release/15.0.9","release/15.0.8.58","release/16.0.17.13","release/15.0.8.57","release/16.0.17.12","release/15.0.8.56","release/15.0.8.55","release/16.0.17.11","release/16.0.17.10","release/15.0.8.54","release/16.0.17.9","release/15.0.8.53","release/16.0.17.8","release/15.0.8.52","release/15.0.8.51","release/16.0.17.7","release/15.0.8.50","release/16.0.17.6","release/16.0.17.5","release/15.0.8.49","release/16.0.17.4","release/16.0.17.3","release/15.0.8.48","release/16.0.17.2","release/15.0.8.47","release/16.0.17.1","release/15.0.8.46","release/16.0.17","release/15.0.8.45","release/15.0.8.44","release/16.0.16","release/15.0.8.43","release/16.0.15","release/15.0.8.42","release/16.0.14","release/15.0.8.41","release/16.0.13","release/15.0.8.40","release/16.0.12","release/15.0.8.39","release/16.0.11","release/15.0.8.38","release/16.0.10","release/15.0.8.37","release/16.0.9","release/15.0.8.36","release/15.0.8.35","release/16.0.8","release/16.0.7","release/15.0.8.34","release/16.0.6","release/15.0.8.33","release/15.0.8.32","release/16.0.5","release/15.0.8.31","release/16.0.4","release/15.0.8.29","release/15.0.8.30","release/16.0.2","release/15.0.8.28","release/15.0.8.27","release/15.0.8.23","release/15.0.8.26","release/15.0.8.25","release/15.0.8.24","release/15.0.8.22","release/15.0.8.21","release/15.0.8.20","release/15.0.8.19","release/15.0.8.18","release/15.0.8.17","release/15.0.8.16","release/15.0.8.15","release/15.0.8.14","release/15.0.8.13","release/15.0.8.12","release/15.0.8.11","release/15.0.8.10","release/15.0.8.9","release/15.0.8.8","release/15.0.8.7","release/15.0.8.6","release/15.0.8.5","release/15.0.8.4","release/15.0.8.3","release/15.0.8.2","release/15.0.8.1","release/15.0.8","release/15.0.7","release/15.0.6","release/15.0.5","release/15.0.4","release/15.0.3","release/15.0.2","release/14.0.4.6","release/14.0.4.5","release/14.0.4.4","release/14.0.4.3","release/14.0.4.2","release/14.0.4.1","release/14.0.4","release/14.0.3.7","release/14.0.3.6","release/14.0.3.5","release/14.0.3.4","release/14.0.3.3","release/14.0.3.2","release/14.0.3.1","release/14.0.3","release/14.0.2","release/14.0.1.1","release/14.0.1","release/14.0.1beta3","release/14.0.1beta2","release/14.0.1beta1","release/14.0.1alpha2","release/14.0.1alpha1","release/13.0.34","release/13.0.33","release/13.0.32","release/13.0.31","release/13.0.30","release/13.0.29","release/13.0.28","release/13.0.27","release/13.0.26","release/13.0.25","release/13.0.24","release/13.0.23","release/13.0.22","release/13.0.21","release/13.0.20","release/13.0.17","release/13.0.16","release/13.0.15","release/13.0.14","release/13.0.13","release/13.0.12","release/13.0.11","release/13.0.10","release/13.0.9","release/13.0.8","release/13.0.6","release/13.0.5","release/13.0.4","release/13.0.3","release/13.0.2","release/13.0.0beta5","release/13.0.0beta4","release/13.0.0beta3","release/13.0.0beta2","release/12.0.0beta1","release/12.0.0alpha3","release/12.0.0alpha2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-55209.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L"}]}