FO
Product
FOSSBilling
42
CVEs
0
On KEV
10.0
Max CVSS
3
New 30D
Severity mix
Critical 6High 13Medium 20Low 3
Watch
Add FOSSBilling to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-43921 | 8.9 | Jul 6 | FOSSBilling vulnerable to arbitrary PHP code injection via unescaped config serialization Affected: >= 0.6.10, < 0.8.0 |
| CVE-2023-3491 | 8.8 | Jun 30 | Unrestricted Upload of File with Dangerous Type in fossbilling/fossbilling Affected: before 0.5.3 |
| CVE-2026-53643 | 8.7 | Jul 6 | FOSSBilling allows low-privileged staff accounts to perform unauthorized actions via admin API endpoints Affected: < 0.8.0 |
| CVE-2026-43918 | 8.7 | Jul 6 | Suspended or inactive FOSSBilling accounts can retain or regain access through existing sessions, API tokens, and password reset flows Affected: < 0.8.0 |
| CVE-2026-53644 | 8.6 | Jul 6 | FOSSBilling's missing order-state validation allows clients to read and reset API key secrets for non-active orders Affected: >= 0.5.3, < 0.8.0 |
| CVE-2026-53645 | 8.5 | Jul 6 | FOSSBilling's missing self-edit prevention in staff permission management allows persistent privilege escalation Affected: < 0.8.0 |
| CVE-2023-3493 | 8.0 | Jun 30 | Improper Neutralization of Formula Elements in a CSV File in fossbilling/fossbilling Affected: before 0.5.3 |
| CVE-2026-53646 | 7.7 | Jul 6 | FOSSBilling: Client password reset token reuse allows persistent account takeover Affected: >= 0.5.6, < 0.8.0 |
| CVE-2026-42331 | 7.7 | Jul 6 | FOSSBilling missing authorization in guest Invoice API endpoints Affected: < 0.8.0 |
| CVE-2023-3230 | 7.5 | Jun 14 | Missing Authorization in fossbilling/fossbilling Affected: before 0.5.0 |
| CVE-2023-3393 | 7.2 | Jun 23 | Code Injection in fossbilling/fossbilling Affected: before 0.5.1 |
| CVE-2026-27708 | 7.1 | Jun 24 | FOSSBilling: IDOR in Servicecustom Client API allows cross-client data access Affected: < 0.8.0 |
| CVE-2026-23513 | 7.1 | Jun 23 | FOSSBilling: Broken Authorization in Client Transaction and Order Listings Affected: < 0.8.0 |
Showing 13