CVE-2025-30004

Xorcom CompletePBX <= 5.2.35 Task Scheduler Authenticated Command Injection

Xorcom CompletePBX is vulnerable to command injection in the administrator Task Scheduler functionality, allowing for attackers to execute arbitrary commands as the root user.This issue affects CompletePBX: all versions up to and prior to 5.2.35

Affected

Xorcom · CompletePBX

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

4.23% chance of exploitation in the next 30 days, 91st percentile

Published

2025-03-31

Updated

2025-12-27

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/xorcom_completepbx_sc…

Security advisories

• https://vulncheck.com/advisories/completepbx-authenticated-command-injection
• https://www.xorcom.com/new-completepbx-release-5-2-36-1

References

• CVE Record
• NVD entry