# cve.now: Fossbilling The newest entries naming Fossbilling as an affected vendor (up to 200), of 43 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md. - [CVE-2026-111048](https://cve.now/CVE-2026-111048.md): FOSSBilling: Low-privileged staff can run JavaScript in administrators' browsers via stored XSS in support ticket notes (CVSS 8.4) - [CVE-2026-112374](https://cve.now/CVE-2026-112374.md): FOSSBilling before 0.8.9 Login CSRF via Staff Guest Login API (CVSS 5.1) - [CVE-2026-111056](https://cve.now/CVE-2026-111056.md): FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint (CVSS 6.9) - [CVE-2026-111053](https://cve.now/CVE-2026-111053.md): FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template\_exists (CVSS 6.9) - [CVE-2026-111046](https://cve.now/CVE-2026-111046.md): FOSSBilling: Low-privileged staff can read and modify configuration of deactivated extensions (CVSS 2.3) - [CVE-2026-53648](https://cve.now/CVE-2026-53648.md): FOSSBilling: Downloadable product files can be overwritten through filename collisions (CVSS 5.1) - [CVE-2026-53647](https://cve.now/CVE-2026-53647.md): FOSSBilling vulnerable to unauthenticated API key configuration disclosure via guest Serviceapikey get\_info endpoint (CVSS 6.9) - [CVE-2026-53646](https://cve.now/CVE-2026-53646.md): FOSSBilling: Client password reset token reuse allows persistent account takeover (CVSS 7.7) - [CVE-2026-53645](https://cve.now/CVE-2026-53645.md): FOSSBilling's missing self-edit prevention in staff permission management allows persistent privilege escalation (CVSS 8.5) - [CVE-2026-53644](https://cve.now/CVE-2026-53644.md): FOSSBilling's missing order-state validation allows clients to read and reset API key secrets for non-active orders (CVSS 8.6) - [CVE-2026-53643](https://cve.now/CVE-2026-53643.md): FOSSBilling allows low-privileged staff accounts to perform unauthorized actions via admin API endpoints (CVSS 8.7) - [CVE-2026-53642](https://cve.now/CVE-2026-53642.md): FOSSBilling: Unverified clients can access client-area pages when email confirmation is required (CVSS 5.3) - [CVE-2026-53641](https://cve.now/CVE-2026-53641.md): FOSSBilling has stored XSS in client email views via unescaped content in JavaScript template literal (CVSS 4.8) - [CVE-2026-53640](https://cve.now/CVE-2026-53640.md): FOSSBilling missing authorization checks on read-only admin API endpoints expose sensitive staff, client, and redirect data (CVSS 2.3) - [CVE-2026-43928](https://cve.now/CVE-2026-43928.md): FOSSBilling: Payment amount not validated in PayPalEmail adapter allows invoice underpayment (CVSS 2.3) - [CVE-2026-43927](https://cve.now/CVE-2026-43927.md): FOSSBilling has race condition in cart checkout that bypasses promo code usage limits (CVSS 6.9) - [CVE-2026-43925](https://cve.now/CVE-2026-43925.md): FOSSBilling: Mass assignment of group\_id in guest client registration allows unauthorized promo code use (CVSS 6.9) - [CVE-2026-43921](https://cve.now/CVE-2026-43921.md): FOSSBilling vulnerable to arbitrary PHP code injection via unescaped config serialization (CVSS 8.9) - [CVE-2026-43918](https://cve.now/CVE-2026-43918.md): Suspended or inactive FOSSBilling accounts can retain or regain access through existing sessions, API tokens, and password reset flows (CVSS 8.7) - [CVE-2026-42331](https://cve.now/CVE-2026-42331.md): FOSSBilling missing authorization in guest Invoice API endpoints (CVSS 7.7) - [CVE-2026-33734](https://cve.now/CVE-2026-33734.md): FOSSBilling has improper SQL neutralization in \`Massmailer\` recipient filters (CVSS 6.9) - [CVE-2026-42341](https://cve.now/CVE-2026-42341.md): FOSSBilling has an unauthenticated payment bypass via IPN callback forgery (CVSS 9.2) - [CVE-2026-43920](https://cve.now/CVE-2026-43920.md): FOSSBilling: Unauthenticated update patcher endpoint allows remote maintenance execution (CVSS 6.9) - [CVE-2026-33543](https://cve.now/CVE-2026-33543.md): FOSSBilling: Authentication bypass allows unauthenticated administrator creation (CVSS 9.3) - [CVE-2026-27708](https://cve.now/CVE-2026-27708.md): FOSSBilling: IDOR in Servicecustom Client API allows cross-client data access (CVSS 7.1) - [CVE-2026-23513](https://cve.now/CVE-2026-23513.md): FOSSBilling: Broken Authorization in Client Transaction and Order Listings (CVSS 7.1) - [CVE-2025-64105](https://cve.now/CVE-2025-64105.md): FOSSBilling: IDOR Vulnerability in Support Ticket Creation (CVSS 5.1) - [CVE-2026-27604](https://cve.now/CVE-2026-27604.md): FOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Access to Privileged Admin Functions (CVSS 10.0) - [CVE-2026-28496](https://cve.now/CVE-2026-28496.md): FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE (CVSS 9.4) - [CVE-2026-43926](https://cve.now/CVE-2026-43926.md): FOSSBilling's password reset confirmation endpoint lacks rate limiting (CVSS 6.3) - [CVE-2026-43924](https://cve.now/CVE-2026-43924.md): FOSSBilling has an open redirect via administrator-configured redirect targets (CVSS 4.8) - [CVE-2026-40495](https://cve.now/CVE-2026-40495.md): FOSSBilling version exposed via asset cache buster (CVSS 6.9) - [CVE-2023-4005](https://cve.now/CVE-2023-4005.md): Insufficient Session Expiration in fossbilling/fossbilling (CVSS 3.8) - [CVE-2023-3521](https://cve.now/CVE-2023-3521.md): Cross-site Scripting (XSS) - Reflected in fossbilling/fossbilling (CVSS 5.4) - [CVE-2023-3493](https://cve.now/CVE-2023-3493.md): Improper Neutralization of Formula Elements in a CSV File in fossbilling/fossbilling (CVSS 7.7) - [CVE-2023-3491](https://cve.now/CVE-2023-3491.md): Unrestricted Upload of File with Dangerous Type in fossbilling/fossbilling (CVSS 8.0) - [CVE-2023-3490](https://cve.now/CVE-2023-3490.md): SQL Injection in fossbilling/fossbilling (CVSS 9.8) - [CVE-2023-3394](https://cve.now/CVE-2023-3394.md): Session Fixation in fossbilling/fossbilling (CVSS 6.8) - [CVE-2023-3393](https://cve.now/CVE-2023-3393.md): Code Injection in fossbilling/fossbilling (CVSS 8.0) - [CVE-2023-3230](https://cve.now/CVE-2023-3230.md): Missing Authorization in fossbilling/fossbilling (CVSS 4.6) - [CVE-2023-3229](https://cve.now/CVE-2023-3229.md): Business Logic Errors in fossbilling/fossbilling (CVSS 5.4) - [CVE-2023-3228](https://cve.now/CVE-2023-3228.md): Business Logic Errors in fossbilling/fossbilling (CVSS 5.4) - [CVE-2023-3227](https://cve.now/CVE-2023-3227.md): Insufficient Granularity of Access Control in fossbilling/fossbilling (CVSS 5.4) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/vendors/fossbilling Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.