CVE-2025-64328
Known exploited · CISA KEV
CVSS 7.2 HIGH: freePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. EPSS 85% (100th percentile).
CISA federal remediation date Feb 24 · date passed
Vulnerabilities & Exploits · Web App Attack
The release also adds an LDAP query option to skip SACL data for non-privileged queries and includes two enhancements and seven bug fixes.
1 source · Mar 20
Known exploited · CISA KEV
CVSS 7.2 HIGH: freePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. EPSS 85% (100th percentile).
CISA federal remediation date Feb 24 · date passed
CVSS 9.8 CRITICAL: aVideo is a video-sharing Platform software. EPSS 9% (95th percentile).
Rapid7
Metasploit Wrap-Up 03/20/2026
Key additions include new exploit modules for: AVideo Encoder getImage.php Unauthenticated Command Injection (CVE-2026-29058).
originalPart of the PlainSec briefing for 2026-03-21
Every edition of this story: Metasploit update adds AVideo, FreePBX exploit modules