FFOSSBilling

Products

Exploited and recent CVEs

• CVE-2026-111048 High 8.4 FOSSBilling: Low-privileged staff can run JavaScript in administrators' browsers via stored XSS in support ticket notes 0.3%
• CVE-2026-112374 Medium 4.3 FOSSBilling before 0.8.9 Login CSRF via Staff Guest Login API 0.2%
• CVE-2026-111056 Medium 6.9 FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint 0.3%
• CVE-2026-111053 Medium 6.9 FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_exists 0.4%
• CVE-2026-111046 Low 2.3 FOSSBilling: Low-privileged staff can read and modify configuration of deactivated extensions 0.2%
• CVE-2026-53648 Medium 5.1 FOSSBilling: Downloadable product files can be overwritten through filename collisions 0.4%
• CVE-2026-53647 Medium 6.9 FOSSBilling vulnerable to unauthenticated API key configuration disclosure via guest Serviceapikey get_info endpoint 0.5%
• CVE-2026-53646 High 7.7 FOSSBilling: Client password reset token reuse allows persistent account takeover 0.3%
• CVE-2026-53645 High 8.5 FOSSBilling's missing self-edit prevention in staff permission management allows persistent privilege escalation 0.4%
• CVE-2026-53644 High 8.6 FOSSBilling's missing order-state validation allows clients to read and reset API key secrets for non-active orders 0.4%
• CVE-2026-53643 High 8.7 FOSSBilling allows low-privileged staff accounts to perform unauthorized actions via admin API endpoints 0.4%
• CVE-2026-53642 Medium 5.3 FOSSBilling: Unverified clients can access client-area pages when email confirmation is required 0.4%
• CVE-2026-53641 Medium 4.8 FOSSBilling has stored XSS in client email views via unescaped content in JavaScript template literal 0.4%
• CVE-2026-53640 Low 2.3 FOSSBilling missing authorization checks on read-only admin API endpoints expose sensitive staff, client, and redirect data 0.4%
• CVE-2026-43928 Low 2.3 FOSSBilling: Payment amount not validated in PayPalEmail adapter allows invoice underpayment 0.4%
• CVE-2026-43927 Medium 6.9 FOSSBilling has race condition in cart checkout that bypasses promo code usage limits 0.3%
• CVE-2026-43925 Medium 6.9 FOSSBilling: Mass assignment of group_id in guest client registration allows unauthorized promo code use 0.5%
• CVE-2026-43921 High 8.9 FOSSBilling vulnerable to arbitrary PHP code injection via unescaped config serialization 0.4%
• CVE-2026-43918 High 8.7 Suspended or inactive FOSSBilling accounts can retain or regain access through existing sessions, API tokens, and password reset flows 0.4%
• CVE-2026-42331 High 7.7 FOSSBilling missing authorization in guest Invoice API endpoints 0.4%
• CVE-2026-33734 Medium 6.9 FOSSBilling has improper SQL neutralization in `Massmailer` recipient filters 0.4%
• CVE-2026-42341 Critical 9.2 FOSSBilling has an unauthenticated payment bypass via IPN callback forgery 0.3%
• CVE-2026-43920 Medium 6.9 FOSSBilling: Unauthenticated update patcher endpoint allows remote maintenance execution 0.9%
• CVE-2026-33543 Critical 9.3 FOSSBilling: Authentication bypass allows unauthenticated administrator creation 0.4%
• CVE-2026-27708 High 7.1 FOSSBilling: IDOR in Servicecustom Client API allows cross-client data access 0.4%
• CVE-2026-23513 High 7.1 FOSSBilling: Broken Authorization in Client Transaction and Order Listings 0.4%
• CVE-2025-64105 Medium 5.1 FOSSBilling: IDOR Vulnerability in Support Ticket Creation 0.4%
• CVE-2026-27604 Critical 10.0 FOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Access to Privileged Admin Functions 1.3%
• CVE-2026-28496 Critical 9.4 FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE 1.9%
• CVE-2026-43926 Medium 6.3 FOSSBilling's password reset confirmation endpoint lacks rate limiting 0.2%