CVE-2025-30004
Xorcom CompletePBX <= 5.2.35 Task Scheduler Authenticated Command Injection
- State
- Published
- Severity
- 8.8 High
- Published
- Mar 31, 2025
- Updated
- Dec 27, 2025
- Reserved
- Mar 13, 2025
Description
Xorcom CompletePBX is vulnerable to command injection in the administrator Task Scheduler functionality, allowing for attackers to execute arbitrary commands as the root user.
This issue affects CompletePBX: all versions up to and prior to 5.2.35
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products
| Product | Versions |
|---|---|
CompletePBXXorcom |
|
References
- https://vulncheck.com/advisories/completepbx-authenticated-command-injectionthird-party-advisory
- https://www.xorcom.com/new-completepbx-release-5-2-36-1/vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.