Vulnerabilities

Filters

1 selected

44 records

Sort

Vendor: FOSSBilling Clear all filters

TI-2026-83925 CVE-2026-111048

Stored cross-site scripting in FOSSBilling support ticket notes

LOW 38

FOSSBilling is an open source billing and client-management platform.

CVSS 4.0HIGH 8.4 Network Low privileges User interaction EPSS 0.00278 Published 2026-11-02 Fixed in 0.8.9 CWE-79

TI-2026-83050 CVE-2026-112374 · GHSA-595p-xmhc-mfxv

Login CSRF in FOSSBilling staff guest login API

LOW 22

FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnerability in the staff guest login endpoint (POST /api/guest/staff/login) that allows remote attackers to force authentication because checkGuestClientAu…

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00172 Published 2026-10-30 Fixed in 0.8.9 CWE-352

TI-2026-76428 CVE-2026-111056

FOSSBilling guest signup enables client account enumeration

LOW 36

FOSSBilling is an open source billing and client-management platform.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00285 Published 2026-10-19 Fixed in 0.8.7 CWE-200

TI-2026-76427 CVE-2026-111053

Path traversal in FOSSBilling reveals whether arbitrary files exist

LOW 37

FOSSBilling is an open source billing and client-management platform.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00368 Published 2026-10-19 Fixed in 0.8.7 CWE-200

TI-2026-76426 CVE-2026-111046

FOSSBilling flaw exposes deactivated extension configuration to staff

LOW 12

FOSSBilling is an open source billing and client-management platform.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00246 Published 2026-10-19 Fixed in 0.8.6 CWE-862

TI-2026-38692 CVE-2026-53648

FOSSBilling: Downloadable product files can be overwritten through filename collisions

LOW 23

FOSSBilling is a free, open-source billing and client management system.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00409 Published 2026-07-06 Fixed in 0.8.1 CWE-668

TI-2026-38691 CVE-2026-53647

FOSSBilling vulnerable to unauthenticated API key configuration disclosure via guest Serviceapikey get_info endpoint

LOW 31

FOSSBilling is a free, open-source billing and client management system.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00543 Published 2026-07-06 Fixed in 0.8.0 CWE-200

TI-2026-38690 CVE-2026-53646

FOSSBilling: Client password reset token reuse allows persistent account takeover

LOW 35

FOSSBilling is a free, open-source billing and client management system.

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.00314 Published 2026-07-06 Fixed in 0.8.0 CWE-640

TI-2026-38689 CVE-2026-53645

FOSSBilling's missing self-edit prevention in staff permission management allows persistent privilege escalation

LOW 37

FOSSBilling is a free, open-source billing and client management system.

CVSS 4.0HIGH 8.5 Network Low privileges No interaction EPSS 0.00372 Published 2026-07-06 Fixed in 0.8.0 CWE-269

TI-2026-38688 CVE-2026-53644

FOSSBilling's missing order-state validation allows clients to read and reset API key secrets for non-active orders

LOW 39

FOSSBilling is a free, open-source billing and client management system.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00389 Published 2026-07-06 Fixed in 0.8.0 CWE-639

TI-2026-38687 CVE-2026-53643

FOSSBilling allows low-privileged staff accounts to perform unauthorized actions via admin API endpoints

MEDIUM 40

FOSSBilling is a free, open-source billing and client management system.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00351 Published 2026-07-06 Fixed in 0.8.0 CWE-200

TI-2026-38686 CVE-2026-53642

FOSSBilling: Unverified clients can access client-area pages when email confirmation is required

LOW 24

FOSSBilling is a free, open-source billing and client management system.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00351 Published 2026-07-06 Fixed in 0.8.0 CWE-863

TI-2026-38685 CVE-2026-53641

FOSSBilling has stored XSS in client email views via unescaped content in JavaScript template literal

LOW 22

FOSSBilling is a free, open-source billing and client management system.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00443 Published 2026-07-06 Fixed in 0.8.0 CWE-79

TI-2026-38684 CVE-2026-53640

Information disclosure in FOSSBilling

LOW 12

FOSSBilling is a free, open-source billing and client management system.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00351 Published 2026-07-06 Fixed in 0.8.0 CWE-200

TI-2026-31988 CVE-2026-43928

FOSSBilling: Payment amount not validated in PayPalEmail adapter allows invoice underpayment

MEDIUM 45

FOSSBilling is a free, open-source billing and client management system.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00424 Published 2026-07-06 Fixed in 0.8.0 CWE-1284

TI-2026-31987 CVE-2026-43927

FOSSBilling has race condition in cart checkout that bypasses promo code usage limits

LOW 30

FOSSBilling is a free, open-source billing and client management system.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0033 Published 2026-07-06 Fixed in 0.8.0 CWE-367

TI-2026-31985 CVE-2026-43925

FOSSBilling: Mass assignment of group_id in guest client registration allows unauthorized promo code use

LOW 37

FOSSBilling is a free, open-source billing and client management system.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00462 Published 2026-07-06 Fixed in 0.8.0 CWE-915

TI-2026-31983 CVE-2026-43921

FOSSBilling vulnerable to arbitrary PHP code injection via unescaped config serialization

MEDIUM 41

FOSSBilling is a free, open-source billing and client management system.

CVSS 4.0HIGH 8.9 Network High privileges No interaction EPSS 0.00425 Published 2026-07-06 Fixed in 0.8.0 CWE-94

TI-2026-31981 CVE-2026-43918

Insufficient session expiration in FOSSBilling

MEDIUM 40

FOSSBilling is a free, open-source billing and client management system.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00364 Published 2026-07-06 Fixed in 0.8.0 CWE-613

TI-2026-30636 CVE-2026-42331

FOSSBilling missing authorization in guest Invoice API endpoints

HIGH 67

FOSSBilling is a free, open-source billing and client management system.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00419 Published 2026-07-06 Fixed in 0.8.0 CWE-306

TI-2026-26113 CVE-2026-33734

FOSSBilling has improper SQL neutralization in `Massmailer` recipient filters

MEDIUM 64

FOSSBilling is a free, open-source billing and client management system.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00369 Published 2026-07-06 Fixed in 0.8.0 CWE-89

TI-2026-30644 CVE-2026-42341

FOSSBilling has an unauthenticated payment bypass via IPN callback forgery

MEDIUM 45

FOSSBilling is a free, open-source billing and client management system.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00272 Published 2026-07-06 Fixed in 0.8.0 CWE-306

TI-2026-31982 CVE-2026-43920

FOSSBilling: Unauthenticated update patcher endpoint allows remote maintenance execution

LOW 38

FOSSBilling is a free, open-source billing and client management system.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00901 Published 2026-06-25 Fixed in 0.8.0 CWE-306

TI-2026-25936 CVE-2026-33543

FOSSBilling: Authentication bypass allows unauthenticated administrator creation

MEDIUM 48

FOSSBilling is a free, open-source billing and client management system.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00447 Published 2026-06-24 Fixed in 0.8.0 CWE-288

TI-2026-22084 CVE-2026-27708

FOSSBilling: IDOR in Servicecustom Client API allows cross-client data access

LOW 31

FOSSBilling is a free, open-source billing and client management system.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00364 Published 2026-06-24 Fixed in 0.8.0 CWE-284