# FOSSBilling.

Every CVE that names FOSSBilling among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [FOSSBilling: Low-privileged staff can run JavaScript in administrators' browsers via stored XSS in support ticket notes](https://agentprime.io/advisories/CVE-2026-111048.md)
  `CVE-2026-111048` · CVE record: FOSSBilling FOSSBilling · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: Cross-site scripting (XSS)
- [FOSSBilling before 0.8.9 Login CSRF via Staff Guest Login API](https://agentprime.io/advisories/CVE-2026-112374.md)
  `CVE-2026-112374` · CVE record: FOSSBilling FOSSBilling · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint](https://agentprime.io/advisories/CVE-2026-111056.md)
  `CVE-2026-111056` · CVE record: FOSSBilling FOSSBilling · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure, Authentication bypass, CWE-204
- [FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_exists](https://agentprime.io/advisories/CVE-2026-111053.md)
  `CVE-2026-111053` · CVE record: FOSSBilling FOSSBilling · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Path traversal, Information disclosure
- [FOSSBilling: Low-privileged staff can read and modify configuration of deactivated extensions](https://agentprime.io/advisories/CVE-2026-111046.md)
  `CVE-2026-111046` · CVE record: FOSSBilling FOSSBilling · CVSS 2.3 Low · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [FOSSBilling: Downloadable product files can be overwritten through filename collisions](https://agentprime.io/advisories/CVE-2026-53648.md)
  `CVE-2026-53648` · CVE record: FOSSBilling FOSSBilling · CVSS 5.1 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Path traversal, Information disclosure
- [FOSSBilling vulnerable to unauthenticated API key configuration disclosure via guest Serviceapikey get_info endpoint](https://agentprime.io/advisories/CVE-2026-53647.md)
  `CVE-2026-53647` · CVE record: FOSSBilling FOSSBilling · CVSS 6.9 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Information disclosure, Authentication bypass, Broken access control
- [FOSSBilling: Client password reset token reuse allows persistent account takeover](https://agentprime.io/advisories/CVE-2026-53646.md)
  `CVE-2026-53646` · CVE record: FOSSBilling FOSSBilling · CVSS 7.7 High · Not analysed yet · Published 6 Jul 2026 · Tags: CWE-640
- [FOSSBilling's missing self-edit prevention in staff permission management allows persistent privilege escalation](https://agentprime.io/advisories/CVE-2026-53645.md)
  `CVE-2026-53645` · CVE record: FOSSBilling FOSSBilling · CVSS 8.5 High · Not analysed yet · Published 6 Jul 2026 · Tags: Privilege escalation
- [FOSSBilling's missing order-state validation allows clients to read and reset API key secrets for non-active orders](https://agentprime.io/advisories/CVE-2026-53644.md)
  `CVE-2026-53644` · CVE record: FOSSBilling FOSSBilling · CVSS 8.6 High · Not analysed yet · Published 6 Jul 2026 · Tags: Broken access control
- [FOSSBilling allows low-privileged staff accounts to perform unauthorized actions via admin API endpoints](https://agentprime.io/advisories/CVE-2026-53643.md)
  `CVE-2026-53643` · CVE record: FOSSBilling FOSSBilling · CVSS 8.7 High · Not analysed yet · Published 6 Jul 2026 · Tags: Information disclosure, Broken access control
- [FOSSBilling: Unverified clients can access client-area pages when email confirmation is required](https://agentprime.io/advisories/CVE-2026-53642.md)
  `CVE-2026-53642` · CVE record: FOSSBilling FOSSBilling · CVSS 5.3 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Broken access control
- [FOSSBilling has stored XSS in client email views via unescaped content in JavaScript template literal](https://agentprime.io/advisories/CVE-2026-53641.md)
  `CVE-2026-53641` · CVE record: FOSSBilling FOSSBilling · CVSS 4.8 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Cross-site scripting (XSS), CWE-838
- [FOSSBilling missing authorization checks on read-only admin API endpoints expose sensitive staff, client, and redirect data](https://agentprime.io/advisories/CVE-2026-53640.md)
  `CVE-2026-53640` · CVE record: FOSSBilling FOSSBilling · CVSS 2.3 Low · Not analysed yet · Published 6 Jul 2026 · Tags: Information disclosure, Broken access control
- [FOSSBilling: Payment amount not validated in PayPalEmail adapter allows invoice underpayment](https://agentprime.io/advisories/CVE-2026-43928.md)
  `CVE-2026-43928` · CVE record: FOSSBilling FOSSBilling · CVSS 2.3 Low · Not analysed yet · Published 6 Jul 2026 · Tags: CWE-754, CWE-1284
- [FOSSBilling has race condition in cart checkout that bypasses promo code usage limits](https://agentprime.io/advisories/CVE-2026-43927.md)
  `CVE-2026-43927` · CVE record: FOSSBilling FOSSBilling · CVSS 6.9 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Race condition
- [FOSSBilling: Mass assignment of group_id in guest client registration allows unauthorized promo code use](https://agentprime.io/advisories/CVE-2026-43925.md)
  `CVE-2026-43925` · CVE record: FOSSBilling FOSSBilling · CVSS 6.9 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Broken access control
- [FOSSBilling vulnerable to arbitrary PHP code injection via unescaped config serialization](https://agentprime.io/advisories/CVE-2026-43921.md)
  `CVE-2026-43921` · CVE record: FOSSBilling FOSSBilling · CVSS 8.9 High · Not analysed yet · Published 6 Jul 2026 · Tags: Code injection
- [Suspended or inactive FOSSBilling accounts can retain or regain access through existing sessions, API tokens, and password reset flows](https://agentprime.io/advisories/CVE-2026-43918.md)
  `CVE-2026-43918` · CVE record: FOSSBilling FOSSBilling · CVSS 8.7 High · Not analysed yet · Published 6 Jul 2026 · Tags: Authentication bypass
- [FOSSBilling missing authorization in guest Invoice API endpoints](https://agentprime.io/advisories/CVE-2026-42331.md)
  `CVE-2026-42331` · CVE record: FOSSBilling FOSSBilling · CVSS 7.7 High · Not analysed yet · Published 6 Jul 2026 · Tags: Authentication bypass, Broken access control
- [FOSSBilling has improper SQL neutralization in \`Massmailer\` recipient filters](https://agentprime.io/advisories/CVE-2026-33734.md)
  `CVE-2026-33734` · CVE record: FOSSBilling FOSSBilling · CVSS 6.9 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: SQL injection
- [FOSSBilling has an unauthenticated payment bypass via IPN callback forgery](https://agentprime.io/advisories/CVE-2026-42341.md)
  `CVE-2026-42341` · CVE record: FOSSBilling FOSSBilling · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jul 2026 · Tags: Authentication bypass, CWE-346
- [FOSSBilling: Unauthenticated update patcher endpoint allows remote maintenance execution](https://agentprime.io/advisories/CVE-2026-43920.md)
  `CVE-2026-43920` · CVE record: FOSSBilling FOSSBilling · CVSS 6.9 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: Authentication bypass
- [FOSSBilling: Authentication bypass allows unauthenticated administrator creation](https://agentprime.io/advisories/CVE-2026-33543.md)
  `CVE-2026-33543` · CVE record: FOSSBilling FOSSBilling · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jun 2026 · Tags: Authentication bypass
- [FOSSBilling: IDOR in Servicecustom Client API allows cross-client data access](https://agentprime.io/advisories/CVE-2026-27708.md)
  `CVE-2026-27708` · CVE record: FOSSBilling FOSSBilling · CVSS 7.1 High · Not analysed yet · Published 24 Jun 2026 · Tags: Broken access control
- [FOSSBilling: Broken Authorization in Client Transaction and Order Listings](https://agentprime.io/advisories/CVE-2026-23513.md)
  `CVE-2026-23513` · CVE record: FOSSBilling FOSSBilling · CVSS 7.1 High · Not analysed yet · Published 23 Jun 2026 · Tags: Broken access control
- [FOSSBilling: IDOR Vulnerability in Support Ticket Creation](https://agentprime.io/advisories/CVE-2025-64105.md)
  `CVE-2025-64105` · CVE record: FOSSBilling FOSSBilling · CVSS 5.1 Medium · Not analysed yet · Published 23 Jun 2026 · Tags: Broken access control
- [FOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Access to Privileged Admin Functions](https://agentprime.io/advisories/CVE-2026-27604.md)
  `CVE-2026-27604` · CVE record: FOSSBilling FOSSBilling · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jun 2026 · Tags: Information disclosure, Authentication bypass, Broken access control
- [FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE](https://agentprime.io/advisories/CVE-2026-28496.md)
  `CVE-2026-28496` · CVE record: FOSSBilling FOSSBilling · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jun 2026 · Tags: Code injection
- [FOSSBilling's password reset confirmation endpoint lacks rate limiting](https://agentprime.io/advisories/CVE-2026-43926.md)
  `CVE-2026-43926` · CVE record: FOSSBilling FOSSBilling · CVSS 6.3 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: Authentication bypass, CWE-204
- [FOSSBilling has an open redirect via administrator-configured redirect targets](https://agentprime.io/advisories/CVE-2026-43924.md)
  `CVE-2026-43924` · CVE record: FOSSBilling FOSSBilling · CVSS 4.8 Medium · Not analysed yet · Published 3 Jun 2026 · Tags: Open redirect
- [FOSSBilling version exposed via asset cache buster](https://agentprime.io/advisories/CVE-2026-40495.md)
  `CVE-2026-40495` · CVE record: FOSSBilling FOSSBilling · CVSS 6.9 Medium · Not analysed yet · Published 3 Jun 2026 · Tags: Information disclosure

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=fossbilling>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/fossbilling/>. Everything for agents: <https://agentprime.io/llms.txt>.