FO
Product
FOSSBilling
42
CVEs
0
On KEV
10.0
Max CVSS
3
New 30D
Severity mix
Critical 6High 13Medium 20Low 3
Watch
Add FOSSBilling to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-111056 | 6.9 | Oct 19 | FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint Affected: >= 0.1.0, < 0.8.7 |
| CVE-2026-111053 | 6.9 | Oct 19 | FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_exists Affected: >= 0.1.0, < 0.8.7 |
| CVE-2026-53647 | 6.9 | Jul 6 | FOSSBilling vulnerable to unauthenticated API key configuration disclosure via guest Serviceapikey get_info endpoint Affected: >= 0.5.3, < 0.8.0 |
| CVE-2026-43927 | 6.9 | Jul 6 | FOSSBilling has race condition in cart checkout that bypasses promo code usage limits Affected: < 0.8.0 |
| CVE-2026-43925 | 6.9 | Jul 6 | FOSSBilling: Mass assignment of group_id in guest client registration allows unauthorized promo code use Affected: < 0.8.0 |
| CVE-2026-33734 | 6.9 | Jul 6 | FOSSBilling has improper SQL neutralization in `Massmailer` recipient filters Affected: >= 0.6.0, < 0.8.0 |
| CVE-2026-43920 | 6.9 | Jun 25 | FOSSBilling: Unauthenticated update patcher endpoint allows remote maintenance execution Affected: >= 0.5.4, < 0.8.0 |
| CVE-2026-40495 | 6.9 | Jun 3 | FOSSBilling version exposed via asset cache buster Affected: < 0.8.0 |
| CVE-2023-3229 | 6.5 | Jun 14 | Business Logic Errors in fossbilling/fossbilling Affected: before 0.5.0 |
| CVE-2026-43926 | 6.3 | Jun 4 | FOSSBilling's password reset confirmation endpoint lacks rate limiting Affected: < 0.8.0 |
| CVE-2023-3521 | 6.1 | Jul 6 | Cross-site Scripting (XSS) - Reflected in fossbilling/fossbilling Affected: before 0.5.4 |
| CVE-2023-3228 | 5.7 | Jun 14 | Business Logic Errors in fossbilling/fossbilling Affected: before 0.5.0 |
| CVE-2023-3227 | 5.7 | Jun 14 | Insufficient Granularity of Access Control in fossbilling/fossbilling Affected: before 0.5.0 |
| CVE-2023-3394 | 5.4 | Jun 23 | Session Fixation in fossbilling/fossbilling Affected: before 0.5.1 |
| CVE-2026-53642 | 5.3 | Jul 6 | FOSSBilling: Unverified clients can access client-area pages when email confirmation is required Affected: >= 0.5.6, < 0.8.0 |
| CVE-2026-53648 | 5.1 | Jul 6 | FOSSBilling: Downloadable product files can be overwritten through filename collisions Affected: < 0.8.1 |
| CVE-2025-64105 | 5.1 | Jun 23 | FOSSBilling: IDOR Vulnerability in Support Ticket Creation Affected: >= 0.6.21, < 0.8.0 |
| CVE-2026-53641 | 4.8 | Jul 6 | FOSSBilling has stored XSS in client email views via unescaped content in JavaScript template literal Affected: >= 0.6.0, < 0.8.0 |
| CVE-2026-43924 | 4.8 | Jun 3 | FOSSBilling has an open redirect via administrator-configured redirect targets Affected: < 0.8.0 |
| CVE-2023-3568 | 4.8 | Jul 10 | Open Redirect in alextselegidis/easyappointments Affected: before 0.5.4 |
Showing 20