Fossbilling vulnerabilities
43 CVEs and advisories name Fossbilling as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-111048FOSSBilling: Low-privileged staff can run JavaScript in administrators' browsers via stored XSS in support ticket notes
- CVE-2026-112374FOSSBilling before 0.8.9 Login CSRF via Staff Guest Login API
- CVE-2026-111056FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint
- CVE-2026-111053FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_exists
- CVE-2026-111046FOSSBilling: Low-privileged staff can read and modify configuration of deactivated extensions
- CVE-2026-53648FOSSBilling: Downloadable product files can be overwritten through filename collisions
- CVE-2026-53647FOSSBilling vulnerable to unauthenticated API key configuration disclosure via guest Serviceapikey get_info endpoint
- CVE-2026-53646FOSSBilling: Client password reset token reuse allows persistent account takeover
- CVE-2026-53645FOSSBilling's missing self-edit prevention in staff permission management allows persistent privilege escalation
- CVE-2026-53644FOSSBilling's missing order-state validation allows clients to read and reset API key secrets for non-active orders
- CVE-2026-53643FOSSBilling allows low-privileged staff accounts to perform unauthorized actions via admin API endpoints
- CVE-2026-53642FOSSBilling: Unverified clients can access client-area pages when email confirmation is required
- CVE-2026-53641FOSSBilling has stored XSS in client email views via unescaped content in JavaScript template literal
- CVE-2026-53640FOSSBilling missing authorization checks on read-only admin API endpoints expose sensitive staff, client, and redirect data
- CVE-2026-43928FOSSBilling: Payment amount not validated in PayPalEmail adapter allows invoice underpayment
- CVE-2026-43927FOSSBilling has race condition in cart checkout that bypasses promo code usage limits
- CVE-2026-43925FOSSBilling: Mass assignment of group_id in guest client registration allows unauthorized promo code use
- CVE-2026-43921FOSSBilling vulnerable to arbitrary PHP code injection via unescaped config serialization
- CVE-2026-43918Suspended or inactive FOSSBilling accounts can retain or regain access through existing sessions, API tokens, and password reset flows
- CVE-2026-42331FOSSBilling missing authorization in guest Invoice API endpoints
- CVE-2026-33734FOSSBilling has improper SQL neutralization in `Massmailer` recipient filters
- CVE-2026-42341FOSSBilling has an unauthenticated payment bypass via IPN callback forgery
- CVE-2026-43920FOSSBilling: Unauthenticated update patcher endpoint allows remote maintenance execution
- CVE-2026-33543FOSSBilling: Authentication bypass allows unauthenticated administrator creation
- CVE-2026-27708FOSSBilling: IDOR in Servicecustom Client API allows cross-client data access
- CVE-2026-23513FOSSBilling: Broken Authorization in Client Transaction and Order Listings
- CVE-2025-64105FOSSBilling: IDOR Vulnerability in Support Ticket Creation
- CVE-2026-27604FOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Access to Privileged Admin Functions
- CVE-2026-28496FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE
- CVE-2026-43926FOSSBilling's password reset confirmation endpoint lacks rate limiting