FOSSBilling

Records44All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical6CVSS 9.0–10.0

CVSS high14CVSS 7.0–8.9

Exploited now

FOSSBilling records in CISA KEV

No FOSSBilling vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Fossbilling 12 records HIGH

Records

44 records

TI-2023-03258 CVE-2023-3490 · GHSA-fx9p-2h37-fpg7

SQL Injection in fossbilling/fossbilling

HIGH 82

SQL Injection in GitHub repository fossbilling/fossbilling prior to 0.5.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00922 Published 2023-06-30 Fixed in 0.5.3 CWE-89

TI-2023-03719 CVE-2023-4005 · GHSA-vq32-qxmx-986v

Insufficient Session Expiration in fossbilling/fossbilling

HIGH 75

Insufficient Session Expiration in GitHub repository fossbilling/fossbilling prior to 0.5.5.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00482 Published 2023-07-31 Fixed in 0.5.5 CWE-613

TI-2023-03259 CVE-2023-3491 · GHSA-99qp-9hmr-6jgh

Unrestricted Upload of File with Dangerous Type in fossbilling/fossbilling

HIGH 73

Unrestricted Upload of File with Dangerous Type in GitHub repository fossbilling/fossbilling prior to 0.5.3.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00889 Published 2023-06-30 Fixed in 0.5.3 CWE-434

TI-2023-03261 CVE-2023-3493 · GHSA-89x9-gx7c-5q2m

Improper Neutralization of Formula Elements in a CSV File in fossbilling/fossbilling

HIGH 70

Improper Neutralization of Formula Elements in a CSV File in GitHub repository fossbilling/fossbilling prior to 0.5.3.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00526 Published 2023-06-30 Fixed in 0.5.3 CWE-1236

TI-2026-30636 CVE-2026-42331

FOSSBilling missing authorization in guest Invoice API endpoints

HIGH 67

FOSSBilling is a free, open-source billing and client management system.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00419 Published 2026-07-06 Fixed in 0.8.0 CWE-306

TI-2023-03173 CVE-2023-3393 · GHSA-82v3-wffx-3hq8

Code Injection in fossbilling/fossbilling

HIGH 67

Code Injection in GitHub repository fossbilling/fossbilling prior to 0.5.1.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01034 Published 2023-06-23 Fixed in 0.5.1 CWE-94

TI-2026-26113 CVE-2026-33734

FOSSBilling has improper SQL neutralization in `Massmailer` recipient filters

MEDIUM 64

FOSSBilling is a free, open-source billing and client management system.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00369 Published 2026-07-06 Fixed in 0.8.0 CWE-89

TI-2023-03330 CVE-2023-3568 · GHSA-gh5w-4mrm-4p4c

Open Redirect in alextselegidis/easyappointments

MEDIUM 61

Open Redirect in GitHub repository alextselegidis/easyappointments prior to 1.5.0.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00434 Published 2023-07-10 Fixed in 1.5.0 CWE-601

TI-2023-03286 CVE-2023-3521 · GHSA-f2hf-p7mp-7x9v

Cross-site Scripting (XSS) - Reflected in fossbilling/fossbilling

MEDIUM 60

Cross-site Scripting (XSS) - Reflected in GitHub repository fossbilling/fossbilling prior to 0.5.4.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00919 Published 2023-07-06 Fixed in 0.5.4 CWE-79

TI-2023-03174 CVE-2023-3394 · GHSA-wcv8-5j5x-hwh5

Session Fixation in fossbilling/fossbilling

MEDIUM 60

Session Fixation in GitHub repository fossbilling/fossbilling prior to 0.5.1.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00506 Published 2023-06-23 Fixed in 0.5.1 CWE-384

TI-2023-03024 CVE-2023-3228 · GHSA-rphw-6wgr-jfrf

Business Logic Errors in fossbilling/fossbilling

MEDIUM 59

Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.00476 Published 2023-06-14 Fixed in 0.5.0 CWE-840

TI-2026-21990 CVE-2026-27604

FOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Access to Privileged Admin Functions

MEDIUM 51

FOSSBilling is a free, open-source billing and client management system.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.01264 Published 2026-06-23 Fixed in 0.8.0 CWE-200

TI-2026-25936 CVE-2026-33543

FOSSBilling: Authentication bypass allows unauthenticated administrator creation

MEDIUM 48

FOSSBilling is a free, open-source billing and client management system.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00447 Published 2026-06-24 Fixed in 0.8.0 CWE-288

TI-2026-22759 CVE-2026-28496

FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE

MEDIUM 46

FOSSBilling is a free, open-source billing and client management system.

CVSS 4.0CRITICAL 9.4 Network High privileges No interaction EPSS 0.01905 Published 2026-06-23 Fixed in 0.8.0 CWE-1336

TI-2026-31988 CVE-2026-43928

FOSSBilling: Payment amount not validated in PayPalEmail adapter allows invoice underpayment

MEDIUM 45

FOSSBilling is a free, open-source billing and client management system.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00424 Published 2026-07-06 Fixed in 0.8.0 CWE-1284

TI-2026-30644 CVE-2026-42341

FOSSBilling has an unauthenticated payment bypass via IPN callback forgery

MEDIUM 45

FOSSBilling is a free, open-source billing and client management system.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00272 Published 2026-07-06 Fixed in 0.8.0 CWE-306

TI-2026-31983 CVE-2026-43921

FOSSBilling vulnerable to arbitrary PHP code injection via unescaped config serialization

MEDIUM 41

FOSSBilling is a free, open-source billing and client management system.

CVSS 4.0HIGH 8.9 Network High privileges No interaction EPSS 0.00425 Published 2026-07-06 Fixed in 0.8.0 CWE-94

TI-2026-38687 CVE-2026-53643

FOSSBilling allows low-privileged staff accounts to perform unauthorized actions via admin API endpoints

MEDIUM 40

FOSSBilling is a free, open-source billing and client management system.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00351 Published 2026-07-06 Fixed in 0.8.0 CWE-200

TI-2026-31981 CVE-2026-43918

Insufficient session expiration in FOSSBilling

MEDIUM 40

FOSSBilling is a free, open-source billing and client management system.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00364 Published 2026-07-06 Fixed in 0.8.0 CWE-613

TI-2026-38688 CVE-2026-53644

FOSSBilling's missing order-state validation allows clients to read and reset API key secrets for non-active orders

LOW 39

FOSSBilling is a free, open-source billing and client management system.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00389 Published 2026-07-06 Fixed in 0.8.0 CWE-639

TI-2026-83925 CVE-2026-111048

Stored cross-site scripting in FOSSBilling support ticket notes

LOW 38

FOSSBilling is an open source billing and client-management platform.

CVSS 4.0HIGH 8.4 Network Low privileges User interaction EPSS 0.00278 Published 2026-11-02 Fixed in 0.8.9 CWE-79

TI-2026-31982 CVE-2026-43920

FOSSBilling: Unauthenticated update patcher endpoint allows remote maintenance execution

LOW 38

FOSSBilling is a free, open-source billing and client management system.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00901 Published 2026-06-25 Fixed in 0.8.0 CWE-306

TI-2026-76427 CVE-2026-111053

Path traversal in FOSSBilling reveals whether arbitrary files exist

LOW 37

FOSSBilling is an open source billing and client-management platform.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00368 Published 2026-10-19 Fixed in 0.8.7 CWE-200

TI-2026-38689 CVE-2026-53645

FOSSBilling's missing self-edit prevention in staff permission management allows persistent privilege escalation

LOW 37

FOSSBilling is a free, open-source billing and client management system.

CVSS 4.0HIGH 8.5 Network Low privileges No interaction EPSS 0.00372 Published 2026-07-06 Fixed in 0.8.0 CWE-269

TI-2026-31985 CVE-2026-43925

FOSSBilling: Mass assignment of group_id in guest client registration allows unauthorized promo code use

LOW 37

FOSSBilling is a free, open-source billing and client management system.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00462 Published 2026-07-06 Fixed in 0.8.0 CWE-915

Open these records in search →