hotspotbilling phpnuxbill

• CVE-2026-108109 Critical 9.1 PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code 0.4%
• CVE-2026-108108 High 7.1 PHPNuxBill through 2025.3.20 CHAP Authentication Bypass via Password::chap_verify() 0.3%
• CVE-2026-108107 Critical 9.8 PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.php 0.4%