CVE-2025-30004

—

CVSS 3.1

8.8 high

EPSS

4%p90

Published

Mar 31, 2025 (Mar 31, 2025)

Modified

Jun 17, 2026

Description

Xorcom CompletePBX is vulnerable to command injection in the administrator Task Scheduler functionality, allowing for attackers to execute arbitrary commands as the root user. This issue affects CompletePBX: all versions up to and prior to 5.2.35

Vendors: xorcom
Products: completepbx
Weakness: CWE-78
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (4.2%)

In the news0 stories

No ingested article mentions this CVE yet.