FOSSBilling vulnerabilities

CVEs per yearBy the year they were published

1. 202311
2. 202632

Newest CVEs

• CVE-2026-111048

  FOSSBilling: Low-privileged staff can run JavaScript in administrators' browsers via stored XSS in support ticket notes

  FOSSBilling · FOSSBilling

  High8.4
• CVE-2026-112374

  FOSSBilling before 0.8.9 Login CSRF via Staff Guest Login API

  FOSSBilling · FOSSBilling

  Medium5.1
• CVE-2026-111056

  FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint

  FOSSBilling · FOSSBilling

  Medium6.9
• CVE-2026-111053

  FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_exists

  FOSSBilling · FOSSBilling

  Medium6.9
• CVE-2026-111046

  FOSSBilling: Low-privileged staff can read and modify configuration of deactivated extensions

  FOSSBilling · FOSSBilling

  Low2.3
• CVE-2026-53648

  FOSSBilling: Downloadable product files can be overwritten through filename collisions

  FOSSBilling · FOSSBilling

  Medium5.1
• CVE-2026-53647

  FOSSBilling vulnerable to unauthenticated API key configuration disclosure via guest Serviceapikey get_info endpoint

  FOSSBilling · FOSSBilling

  Medium6.9
• CVE-2026-53646

  FOSSBilling: Client password reset token reuse allows persistent account takeover

  FOSSBilling · FOSSBilling

  High7.7
• CVE-2026-53645

  FOSSBilling's missing self-edit prevention in staff permission management allows persistent privilege escalation

  FOSSBilling · FOSSBilling

  High8.5
• CVE-2026-53644

  FOSSBilling's missing order-state validation allows clients to read and reset API key secrets for non-active orders

  FOSSBilling · FOSSBilling

  High8.6