---
id: "CVE-2026-105321"
kind: "vulnerability"
aliases: ["CVE-2026-105321"]
title: "Kobikom PBX: SQL injection flaw before KobiPBX-FOP3-SEC-r1"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["kobikom", "kobipbx", "other", "pbx", "telephony"]
not_affected_if: ["already-on-kobipbx-fop3-sec-r1-or-later"]
published_at: "2026-11-05T14:16:59+00:00"
first_seen_at: "2026-11-05T14:39:16+00:00"
updated_at: "2026-11-05T14:40:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105321", "first_seen_at": "2026-11-05T14:39:16+00:00"}]
exploit_sources: []
---

# Kobikom PBX: SQL injection flaw before KobiPBX-FOP3-SEC-r1

Kobikom's KobiPBX product has an SQL injection flaw, where crafted input is passed unchecked into database queries. The sources do not say what an attacker can read or change beyond that.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether you run KobiPBX and which build it is; the affected range is before `KobiPBX-FOP3-SEC-r1`

## Fix

- KobiPBX: move to `KobiPBX-FOP3-SEC-r1` or later

## Timeline

- 2026-11-05T14:39:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105321

## From the sources

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Kobikom Telecommunications and Informatics Services Inc. Kobikom allows SQL Injection.

This issue affects Kobikom: before KobiPBX-FOP3-SEC-r1.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_