These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
Frogman provides headless FreePBX control. Prior to version 1.6.6, Frogman's chat-console markdown formatter (`assets/js/chat.js`'s `formatMarkdown`) inserted regex capture groups as raw HTML in four template patterns: inline code, bold, markdown links, and download links. Tool responses that reflect user-controlled fields — extension names, ring-group descriptions, IVR names, queue descriptions, etc. — c [truncated]
CVE-2026-46515 is a critical security vulnerability in Frogman, a headless PBX control system. Prior to version 1.6.3, the system did not properly restrict access to certain functions, allowing users with PERM_READ access to call sensitive functions and expose sensitive information, including AMI manager secrets, outbound dial PINs, full Asterisk dialplan context, root SSH connection commands, backup arti [truncated]
CVE-2026-46514: Frogman Plaintext Credential Exposure. The Frogman headless PBX control system, prior to version 1.6.2, had two key issues. Firstly, the 'fm_reset_password' function in Tools/ResetPassword.php returned plaintext passwords. Secondly, the 'fm_add_extension' function in Tools/AddExtension.php returned plaintext secrets. These issues were compounded by the fact that the audit logs, specificall [truncated]
Frogman, a headless PBX control system, stored API tokens generated by Tools/CreateApiToken.php as raw bin2hex(random_bytes(32)) strings in oc_api_tokens. The Frogman.class.php file authenticated the X-Frogman-Token header by comparing it with the stored raw value. This insecure practice allowed database read access to recover reusable active tokens at their assigned permission level, including admin. The [truncated]
CVE-2026-46512 is a critical vulnerability in Frogman, a headless PBX control system. Prior to version 1.6.2, the fm_dialplan_apply function accepted template parameters, including greeting, dest, url, extension, code, and file. These parameters were used to write output to extensions_custom.conf without proper sanitization, allowing a PERM_WRITE caller with confirm:true to inject arbitrary Asterisk direc [truncated]