FO
Product
FOSSBilling
42
CVEs
0
On KEV
10.0
Max CVSS
3
New 30D
Severity mix
Critical 6High 13Medium 20Low 3
Watch
Add FOSSBilling to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-27604 | 10.0 | Jun 23 | FOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Access to Privileged Admin Functions Affected: >= 0.5.4, < 0.8.0 |
| CVE-2023-4005 | 9.8 | Jul 31 | Insufficient Session Expiration in fossbilling/fossbilling Affected: before 0.5.5 |
| CVE-2023-3490 | 9.8 | Jun 30 | SQL Injection in fossbilling/fossbilling Affected: before 0.5.3 |
| CVE-2026-28496 | 9.4 | Jun 23 | FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE Affected: < 0.8.0 |
| CVE-2026-33543 | 9.3 | Jun 24 | FOSSBilling: Authentication bypass allows unauthenticated administrator creation Affected: < 0.8.0 |
| CVE-2026-42341 | 9.2 | Jul 6 | FOSSBilling has an unauthenticated payment bypass via IPN callback forgery Affected: >= 0.6.0, < 0.8.0 |
| CVE-2026-43921 | 8.9 | Jul 6 | FOSSBilling vulnerable to arbitrary PHP code injection via unescaped config serialization Affected: >= 0.6.10, < 0.8.0 |
| CVE-2023-3491 | 8.8 | Jun 30 | Unrestricted Upload of File with Dangerous Type in fossbilling/fossbilling Affected: before 0.5.3 |
| CVE-2026-53643 | 8.7 | Jul 6 | FOSSBilling allows low-privileged staff accounts to perform unauthorized actions via admin API endpoints Affected: < 0.8.0 |
| CVE-2026-43918 | 8.7 | Jul 6 | Suspended or inactive FOSSBilling accounts can retain or regain access through existing sessions, API tokens, and password reset flows Affected: < 0.8.0 |
| CVE-2026-53644 | 8.6 | Jul 6 | FOSSBilling's missing order-state validation allows clients to read and reset API key secrets for non-active orders Affected: >= 0.5.3, < 0.8.0 |
| CVE-2026-53645 | 8.5 | Jul 6 | FOSSBilling's missing self-edit prevention in staff permission management allows persistent privilege escalation Affected: < 0.8.0 |
| CVE-2023-3493 | 8.0 | Jun 30 | Improper Neutralization of Formula Elements in a CSV File in fossbilling/fossbilling Affected: before 0.5.3 |
| CVE-2026-53646 | 7.7 | Jul 6 | FOSSBilling: Client password reset token reuse allows persistent account takeover Affected: >= 0.5.6, < 0.8.0 |
| CVE-2026-42331 | 7.7 | Jul 6 | FOSSBilling missing authorization in guest Invoice API endpoints Affected: < 0.8.0 |
| CVE-2023-3230 | 7.5 | Jun 14 | Missing Authorization in fossbilling/fossbilling Affected: before 0.5.0 |
| CVE-2023-3393 | 7.2 | Jun 23 | Code Injection in fossbilling/fossbilling Affected: before 0.5.1 |
| CVE-2026-27708 | 7.1 | Jun 24 | FOSSBilling: IDOR in Servicecustom Client API allows cross-client data access Affected: < 0.8.0 |
| CVE-2026-23513 | 7.1 | Jun 23 | FOSSBilling: Broken Authorization in Client Transaction and Order Listings Affected: < 0.8.0 |
| CVE-2026-111056 | 6.9 | Oct 19 | FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint Affected: >= 0.1.0, < 0.8.7 |
| CVE-2026-111053 | 6.9 | Oct 19 | FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_exists Affected: >= 0.1.0, < 0.8.7 |
| CVE-2026-53647 | 6.9 | Jul 6 | FOSSBilling vulnerable to unauthenticated API key configuration disclosure via guest Serviceapikey get_info endpoint Affected: >= 0.5.3, < 0.8.0 |
| CVE-2026-43927 | 6.9 | Jul 6 | FOSSBilling has race condition in cart checkout that bypasses promo code usage limits Affected: < 0.8.0 |
| CVE-2026-43925 | 6.9 | Jul 6 | FOSSBilling: Mass assignment of group_id in guest client registration allows unauthorized promo code use Affected: < 0.8.0 |
| CVE-2026-33734 | 6.9 | Jul 6 | FOSSBilling has improper SQL neutralization in `Massmailer` recipient filters Affected: >= 0.6.0, < 0.8.0 |
| CVE-2026-43920 | 6.9 | Jun 25 | FOSSBilling: Unauthenticated update patcher endpoint allows remote maintenance execution Affected: >= 0.5.4, < 0.8.0 |
| CVE-2026-40495 | 6.9 | Jun 3 | FOSSBilling version exposed via asset cache buster Affected: < 0.8.0 |
| CVE-2023-3229 | 6.5 | Jun 14 | Business Logic Errors in fossbilling/fossbilling Affected: before 0.5.0 |
| CVE-2026-43926 | 6.3 | Jun 4 | FOSSBilling's password reset confirmation endpoint lacks rate limiting Affected: < 0.8.0 |
| CVE-2023-3521 | 6.1 | Jul 6 | Cross-site Scripting (XSS) - Reflected in fossbilling/fossbilling Affected: before 0.5.4 |
| CVE-2023-3228 | 5.7 | Jun 14 | Business Logic Errors in fossbilling/fossbilling Affected: before 0.5.0 |
| CVE-2023-3227 | 5.7 | Jun 14 | Insufficient Granularity of Access Control in fossbilling/fossbilling Affected: before 0.5.0 |
| CVE-2023-3394 | 5.4 | Jun 23 | Session Fixation in fossbilling/fossbilling Affected: before 0.5.1 |
| CVE-2026-53642 | 5.3 | Jul 6 | FOSSBilling: Unverified clients can access client-area pages when email confirmation is required Affected: >= 0.5.6, < 0.8.0 |
| CVE-2026-53648 | 5.1 | Jul 6 | FOSSBilling: Downloadable product files can be overwritten through filename collisions Affected: < 0.8.1 |
| CVE-2025-64105 | 5.1 | Jun 23 | FOSSBilling: IDOR Vulnerability in Support Ticket Creation Affected: >= 0.6.21, < 0.8.0 |
| CVE-2026-53641 | 4.8 | Jul 6 | FOSSBilling has stored XSS in client email views via unescaped content in JavaScript template literal Affected: >= 0.6.0, < 0.8.0 |
| CVE-2026-43924 | 4.8 | Jun 3 | FOSSBilling has an open redirect via administrator-configured redirect targets Affected: < 0.8.0 |
| CVE-2023-3568 | 4.8 | Jul 10 | Open Redirect in alextselegidis/easyappointments Affected: before 0.5.4 |
| CVE-2026-111046 | 2.3 | Oct 19 | FOSSBilling: Low-privileged staff can read and modify configuration of deactivated extensions Affected: >= 0.8.4, < 0.8.6 |
| CVE-2026-53640 | 2.3 | Jul 6 | FOSSBilling missing authorization checks on read-only admin API endpoints expose sensitive staff, client, and redirect data Affected: < 0.8.0 |
| CVE-2026-43928 | 2.3 | Jul 6 | FOSSBilling: Payment amount not validated in PayPalEmail adapter allows invoice underpayment Affected: < 0.8.0 |
Showing 42