Skip to content
Fossbilling vulnerabilities
Newest
-
fossbilling
FOSSBilling: Low-privileged staff can run JavaScript in administrators' browsers via stored XSS in support ticket notes
CVE-2026-111048
8.4 High
-
fossbilling
FOSSBilling before 0.8.9 Login CSRF via Staff Guest Login API
CVE-2026-112374
5.1 Medium
-
fossbilling
FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint
CVE-2026-111056
6.9 Medium
-
fossbilling
FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_exists
CVE-2026-111053
6.9 Medium
-
fossbilling
FOSSBilling: Low-privileged staff can read and modify configuration of deactivated extensions
CVE-2026-111046
2.3 Low
-
fossbilling
FOSSBilling: Downloadable product files can be overwritten through filename collisions
CVE-2026-53648
5.1 Medium
-
fossbilling
FOSSBilling vulnerable to unauthenticated API key configuration disclosure via guest Serviceapikey get_info endpoint
CVE-2026-53647
Public exploit
6.9 Medium
-
fossbilling
FOSSBilling: Client password reset token reuse allows persistent account takeover
CVE-2026-53646
7.7 High
-
fossbilling
FOSSBilling's missing self-edit prevention in staff permission management allows persistent privilege escalation
CVE-2026-53645
8.5 High
-
fossbilling
FOSSBilling's missing order-state validation allows clients to read and reset API key secrets for non-active orders
CVE-2026-53644
8.6 High
-
fossbilling
FOSSBilling allows low-privileged staff accounts to perform unauthorized actions via admin API endpoints
CVE-2026-53643
8.7 High
-
fossbilling
FOSSBilling: Unverified clients can access client-area pages when email confirmation is required
CVE-2026-53642
5.3 Medium
-
fossbilling
FOSSBilling has stored XSS in client email views via unescaped content in JavaScript template literal
CVE-2026-53641
4.8 Medium
-
fossbilling
FOSSBilling missing authorization checks on read-only admin API endpoints expose sensitive staff, client, and redirect data
CVE-2026-53640
2.3 Low
-
fossbilling
FOSSBilling: Payment amount not validated in PayPalEmail adapter allows invoice underpayment
CVE-2026-43928
2.3 Low
-
fossbilling
FOSSBilling has race condition in cart checkout that bypasses promo code usage limits
CVE-2026-43927
6.9 Medium
-
fossbilling
FOSSBilling: Mass assignment of group_id in guest client registration allows unauthorized promo code use
CVE-2026-43925
6.9 Medium
-
fossbilling
FOSSBilling vulnerable to arbitrary PHP code injection via unescaped config serialization
CVE-2026-43921
8.9 High
-
fossbilling
Suspended or inactive FOSSBilling accounts can retain or regain access through existing sessions, API tokens, and password reset flows
CVE-2026-43918
8.7 High
-
fossbilling
FOSSBilling missing authorization in guest Invoice API endpoints
CVE-2026-42331
7.7 High
-
fossbilling
FOSSBilling has improper SQL neutralization in `Massmailer` recipient filters
CVE-2026-33734
6.9 Medium
-
fossbilling
FOSSBilling has an unauthenticated payment bypass via IPN callback forgery
CVE-2026-42341
9.2 Critical
-
fossbilling
FOSSBilling: Unauthenticated update patcher endpoint allows remote maintenance execution
CVE-2026-43920
6.9 Medium
-
fossbilling
FOSSBilling: Authentication bypass allows unauthenticated administrator creation
CVE-2026-33543
9.3 Critical
-
fossbilling
FOSSBilling: IDOR in Servicecustom Client API allows cross-client data access
CVE-2026-27708
7.1 High
-
fossbilling
FOSSBilling: Broken Authorization in Client Transaction and Order Listings
CVE-2026-23513
7.1 High
-
fossbilling
FOSSBilling: IDOR Vulnerability in Support Ticket Creation
CVE-2025-64105
5.1 Medium
-
fossbilling
FOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Access to Privileged Admin Functions
CVE-2026-27604
10.0 Critical
-
fossbilling
FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE
CVE-2026-28496
Public exploit
9.4 Critical
-
fossbilling
FOSSBilling's password reset confirmation endpoint lacks rate limiting
CVE-2026-43926
6.3 Medium
-
fossbilling
FOSSBilling has an open redirect via administrator-configured redirect targets
CVE-2026-43924
4.8 Medium
-
fossbilling
FOSSBilling version exposed via asset cache buster
CVE-2026-40495
6.9 Medium
-
fossbilling, fossbilling fossbilling/fossbilling +1 more
Insufficient Session Expiration in fossbilling/fossbilling
CVE-2023-4005
3.8 Low
-
alextselegidis alextselegidis/easyappointments, easyappointments, fossbilling +2 more
Open Redirect in alextselegidis/easyappointments
CVE-2023-3568
6.3 Medium
-
fossbilling, fossbilling fossbilling/fossbilling +1 more
Cross-site Scripting (XSS) - Reflected in fossbilling/fossbilling
CVE-2023-3521
5.4 Medium
-
fossbilling, fossbilling fossbilling/fossbilling +1 more
Improper Neutralization of Formula Elements in a CSV File in fossbilling/fossbilling
CVE-2023-3493
7.7 High
-
fossbilling, fossbilling fossbilling/fossbilling +1 more
Unrestricted Upload of File with Dangerous Type in fossbilling/fossbilling
CVE-2023-3491
8.0 High
-
fossbilling, fossbilling fossbilling/fossbilling +1 more
SQL Injection in fossbilling/fossbilling
CVE-2023-3490
9.8 Critical
-
fossbilling, fossbilling fossbilling/fossbilling +1 more
Session Fixation in fossbilling/fossbilling
CVE-2023-3394
6.8 Medium
-
fossbilling, fossbilling fossbilling/fossbilling +1 more
Code Injection in fossbilling/fossbilling
CVE-2023-3393
8.0 High
-
fossbilling, fossbilling fossbilling/fossbilling +1 more
Missing Authorization in fossbilling/fossbilling
CVE-2023-3230
4.6 Medium
-
fossbilling, fossbilling fossbilling/fossbilling +1 more
Business Logic Errors in fossbilling/fossbilling
CVE-2023-3229
5.4 Medium
-
fossbilling, fossbilling fossbilling/fossbilling +1 more
Business Logic Errors in fossbilling/fossbilling
CVE-2023-3228
5.4 Medium
-
fossbilling, fossbilling fossbilling/fossbilling +1 more
Insufficient Granularity of Access Control in fossbilling/fossbilling
CVE-2023-3227
5.4 Medium