Read the docs

hotspotbilling

Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

hotspotbilling records in CISA KEV

No hotspotbilling vulnerabilities are listed in CISA KEV.

Records

3 records

TI-2026-70067 CVE-2026-108109

Account takeover in PHPNuxBill via brute-forceable reset code

Priority HIGH 81

PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00388 Published 2026-10-09 No fix listed CWE-307
TI-2026-70065 CVE-2026-108107

PHPNuxBill unauthenticated SQL injection via radius.php REST endpoint

Priority HIGH 81

PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00411 Published 2026-10-09 No fix listed CWE-89
TI-2026-70066 CVE-2026-108108

PHPNuxBill CHAP authentication bypass accepts wrong passwords

Priority MEDIUM 64

PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in RADIUS CHAP verification because Password::chap_verify() returns true when the supplied response does not match.

CVSS 4.0HIGH 7.1 Adjacent network No auth No interaction EPSS 0.00341 Published 2026-10-09 No fix listed CWE-287
Open these records in search →