FO
Vendor
FOSSBilling
54
CVEs
0
On KEV
4
New 30D
Products
FO10.0
FOSSBilling
FOSSBilling
43 CVEs0 on KEV4 new
FO9.8
fossbilling/fossbilling
fossbilling
11 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-112374 New | FO FOSSBilling FOSSBilling | 4.3 | Oct 30 | FOSSBilling before 0.8.9 Login CSRF via Staff Guest Login API |
| CVE-2026-111056 | FO FOSSBilling FOSSBilling | 6.9 | Oct 19 | FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint |
| CVE-2026-111053 | FO FOSSBilling FOSSBilling | 6.9 | Oct 19 | FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_exists |
| CVE-2026-111046 | FO FOSSBilling FOSSBilling | 2.3 | Oct 19 | FOSSBilling: Low-privileged staff can read and modify configuration of deactivated extensions |
| CVE-2026-53648 | FO FOSSBilling FOSSBilling | 5.1 | Jul 6 | FOSSBilling: Downloadable product files can be overwritten through filename collisions |
| CVE-2026-53647 | FO FOSSBilling FOSSBilling | 6.9 | Jul 6 | FOSSBilling vulnerable to unauthenticated API key configuration disclosure via guest Serviceapikey get_info endpoint |
| CVE-2026-53646 | FO FOSSBilling FOSSBilling | 7.7 | Jul 6 | FOSSBilling: Client password reset token reuse allows persistent account takeover |
| CVE-2026-53645 | FO FOSSBilling FOSSBilling | 8.5 | Jul 6 | FOSSBilling's missing self-edit prevention in staff permission management allows persistent privilege escalation |
| CVE-2026-53644 | FO FOSSBilling FOSSBilling | 8.6 | Jul 6 | FOSSBilling's missing order-state validation allows clients to read and reset API key secrets for non-active orders |
| CVE-2026-53643 | FO FOSSBilling FOSSBilling | 8.7 | Jul 6 | FOSSBilling allows low-privileged staff accounts to perform unauthorized actions via admin API endpoints |
| CVE-2026-53642 | FO FOSSBilling FOSSBilling | 5.3 | Jul 6 | FOSSBilling: Unverified clients can access client-area pages when email confirmation is required |
| CVE-2026-53641 | FO FOSSBilling FOSSBilling | 4.8 | Jul 6 | FOSSBilling has stored XSS in client email views via unescaped content in JavaScript template literal |
| CVE-2026-53640 | FO FOSSBilling FOSSBilling | 2.3 | Jul 6 | FOSSBilling missing authorization checks on read-only admin API endpoints expose sensitive staff, client, and redirect data |
| CVE-2026-43928 | FO FOSSBilling FOSSBilling | 2.3 | Jul 6 | FOSSBilling: Payment amount not validated in PayPalEmail adapter allows invoice underpayment |
| CVE-2026-43927 | FO FOSSBilling FOSSBilling | 6.9 | Jul 6 | FOSSBilling has race condition in cart checkout that bypasses promo code usage limits |
| CVE-2026-43925 | FO FOSSBilling FOSSBilling | 6.9 | Jul 6 | FOSSBilling: Mass assignment of group_id in guest client registration allows unauthorized promo code use |
| CVE-2026-43921 | FO FOSSBilling FOSSBilling | 8.9 | Jul 6 | FOSSBilling vulnerable to arbitrary PHP code injection via unescaped config serialization |
| CVE-2026-43918 | FO FOSSBilling FOSSBilling | 8.7 | Jul 6 | Suspended or inactive FOSSBilling accounts can retain or regain access through existing sessions, API tokens, and password reset flows |
| CVE-2026-42331 | FO FOSSBilling FOSSBilling | 7.7 | Jul 6 | FOSSBilling missing authorization in guest Invoice API endpoints |
| CVE-2026-33734 | FO FOSSBilling FOSSBilling | 6.9 | Jul 6 | FOSSBilling has improper SQL neutralization in `Massmailer` recipient filters |
| CVE-2026-42341 | FO FOSSBilling FOSSBilling | 9.2 | Jul 6 | FOSSBilling has an unauthenticated payment bypass via IPN callback forgery |
| CVE-2026-43920 | FO FOSSBilling FOSSBilling | 6.9 | Jun 25 | FOSSBilling: Unauthenticated update patcher endpoint allows remote maintenance execution |
| CVE-2026-33543 | FO FOSSBilling FOSSBilling | 9.3 | Jun 24 | FOSSBilling: Authentication bypass allows unauthenticated administrator creation |
| CVE-2026-27708 | FO FOSSBilling FOSSBilling | 7.1 | Jun 24 | FOSSBilling: IDOR in Servicecustom Client API allows cross-client data access |
| CVE-2026-23513 | FO FOSSBilling FOSSBilling | 7.1 | Jun 23 | FOSSBilling: Broken Authorization in Client Transaction and Order Listings |
| CVE-2025-64105 | FO FOSSBilling FOSSBilling | 5.1 | Jun 23 | FOSSBilling: IDOR Vulnerability in Support Ticket Creation |
| CVE-2026-27604 | FO FOSSBilling FOSSBilling | 10.0 | Jun 23 | FOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Access to Privileged Admin Functions |
| CVE-2026-28496 | FO FOSSBilling FOSSBilling | 9.4 | Jun 23 | FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE |
| CVE-2026-43926 | FO FOSSBilling FOSSBilling | 6.3 | Jun 4 | FOSSBilling's password reset confirmation endpoint lacks rate limiting |
| CVE-2026-43924 | FO FOSSBilling FOSSBilling | 4.8 | Jun 3 | FOSSBilling has an open redirect via administrator-configured redirect targets |
| CVE-2026-40495 | FO FOSSBilling FOSSBilling | 6.9 | Jun 3 | FOSSBilling version exposed via asset cache buster |
| CVE-2023-4005 | FO fossbilling/fossbilling fossbilling | 9.8 | Jul 31 | Insufficient Session Expiration in fossbilling/fossbilling |
| CVE-2023-3568 | FO Fossbilling Fossbilling | 4.8 | Jul 10 | Open Redirect in alextselegidis/easyappointments |
| CVE-2023-3521 | FO fossbilling/fossbilling fossbilling | 6.1 | Jul 6 | Cross-site Scripting (XSS) - Reflected in fossbilling/fossbilling |
| CVE-2023-3493 | FO fossbilling/fossbilling fossbilling | 8.0 | Jun 30 | Improper Neutralization of Formula Elements in a CSV File in fossbilling/fossbilling |
| CVE-2023-3491 | FO fossbilling/fossbilling fossbilling | 8.8 | Jun 30 | Unrestricted Upload of File with Dangerous Type in fossbilling/fossbilling |
| CVE-2023-3490 | FO fossbilling/fossbilling fossbilling | 9.8 | Jun 30 | SQL Injection in fossbilling/fossbilling |
| CVE-2023-3394 | FO fossbilling/fossbilling fossbilling | 5.4 | Jun 23 | Session Fixation in fossbilling/fossbilling |
| CVE-2023-3393 | FO fossbilling/fossbilling fossbilling | 7.2 | Jun 23 | Code Injection in fossbilling/fossbilling |
| CVE-2023-3228 | FO fossbilling/fossbilling fossbilling | 5.7 | Jun 14 | Business Logic Errors in fossbilling/fossbilling |
| CVE-2023-3230 | FO fossbilling/fossbilling fossbilling | 7.5 | Jun 14 | Missing Authorization in fossbilling/fossbilling |
| CVE-2023-3229 | FO fossbilling/fossbilling fossbilling | 6.5 | Jun 14 | Business Logic Errors in fossbilling/fossbilling |
| CVE-2023-3227 | FO fossbilling/fossbilling fossbilling | 5.7 | Jun 14 | Insufficient Granularity of Access Control in fossbilling/fossbilling |