FOSSBilling vulnerabilities
43 published CVEs name FOSSBilling among the affected products.
- 43Published CVEs43 of them scored
- 32Last 12 monthspublished in the last year
- 5Critical13 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-111048
FOSSBilling: Low-privileged staff can run JavaScript in administrators' browsers via stored XSS in support ticket notes
FOSSBilling · FOSSBilling
High8.4 - CVE-2026-112374
FOSSBilling before 0.8.9 Login CSRF via Staff Guest Login API
FOSSBilling · FOSSBilling
Medium5.1 - CVE-2026-111056
FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint
FOSSBilling · FOSSBilling
Medium6.9 - CVE-2026-111053
FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_exists
FOSSBilling · FOSSBilling
Medium6.9 - CVE-2026-111046
FOSSBilling: Low-privileged staff can read and modify configuration of deactivated extensions
FOSSBilling · FOSSBilling
Low2.3 - CVE-2026-53648
FOSSBilling: Downloadable product files can be overwritten through filename collisions
FOSSBilling · FOSSBilling
Medium5.1 - CVE-2026-53647
FOSSBilling vulnerable to unauthenticated API key configuration disclosure via guest Serviceapikey get_info endpoint
FOSSBilling · FOSSBilling
Medium6.9 - CVE-2026-53646
FOSSBilling: Client password reset token reuse allows persistent account takeover
FOSSBilling · FOSSBilling
High7.7 - CVE-2026-53645
FOSSBilling's missing self-edit prevention in staff permission management allows persistent privilege escalation
FOSSBilling · FOSSBilling
High8.5 - CVE-2026-53644
FOSSBilling's missing order-state validation allows clients to read and reset API key secrets for non-active orders
FOSSBilling · FOSSBilling
High8.6