FOSSBilling.

FOSSBilling: Low-privileged staff can run JavaScript in administrators' browsers via stored XSS in support ticket notes

• FOSSBilling
• Cross-site scripting (XSS)

FOSSBilling before 0.8.9 Login CSRF via Staff Guest Login API

• FOSSBilling
• Cross-site request forgery (CSRF)

FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint

• FOSSBilling
• Information disclosure
• Authentication bypass

FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_exists

• FOSSBilling
• Path traversal
• Information disclosure

FOSSBilling: Low-privileged staff can read and modify configuration of deactivated extensions

• FOSSBilling
• Broken access control

FOSSBilling: Downloadable product files can be overwritten through filename collisions

• FOSSBilling
• Path traversal
• Information disclosure

FOSSBilling vulnerable to unauthenticated API key configuration disclosure via guest Serviceapikey get_info endpoint

• FOSSBilling
• Information disclosure
• Authentication bypass

FOSSBilling: Client password reset token reuse allows persistent account takeover

• FOSSBilling
• CWE-640

FOSSBilling's missing self-edit prevention in staff permission management allows persistent privilege escalation

• FOSSBilling
• Privilege escalation

FOSSBilling's missing order-state validation allows clients to read and reset API key secrets for non-active orders

• FOSSBilling
• Broken access control

FOSSBilling allows low-privileged staff accounts to perform unauthorized actions via admin API endpoints

• FOSSBilling
• Information disclosure
• Broken access control

FOSSBilling: Unverified clients can access client-area pages when email confirmation is required

• FOSSBilling
• Broken access control

FOSSBilling has stored XSS in client email views via unescaped content in JavaScript template literal

• FOSSBilling
• Cross-site scripting (XSS)
• CWE-838

FOSSBilling missing authorization checks on read-only admin API endpoints expose sensitive staff, client, and redirect data

• FOSSBilling
• Information disclosure
• Broken access control

FOSSBilling: Payment amount not validated in PayPalEmail adapter allows invoice underpayment

• FOSSBilling
• CWE-754
• CWE-1284

FOSSBilling has race condition in cart checkout that bypasses promo code usage limits

• FOSSBilling
• Race condition

FOSSBilling: Mass assignment of group_id in guest client registration allows unauthorized promo code use

• FOSSBilling
• Broken access control

FOSSBilling vulnerable to arbitrary PHP code injection via unescaped config serialization

• FOSSBilling
• Code injection

Suspended or inactive FOSSBilling accounts can retain or regain access through existing sessions, API tokens, and password reset flows

• FOSSBilling
• Authentication bypass

FOSSBilling missing authorization in guest Invoice API endpoints

• FOSSBilling
• Authentication bypass
• Broken access control

FOSSBilling has improper SQL neutralization in `Massmailer` recipient filters

• FOSSBilling
• SQL injection

FOSSBilling has an unauthenticated payment bypass via IPN callback forgery

• FOSSBilling
• Authentication bypass
• CWE-346

FOSSBilling: Unauthenticated update patcher endpoint allows remote maintenance execution

• FOSSBilling
• Authentication bypass

FOSSBilling: Authentication bypass allows unauthenticated administrator creation

• FOSSBilling
• Authentication bypass

FOSSBilling: IDOR in Servicecustom Client API allows cross-client data access

• FOSSBilling
• Broken access control

FOSSBilling: Broken Authorization in Client Transaction and Order Listings

• FOSSBilling
• Broken access control

FOSSBilling: IDOR Vulnerability in Support Ticket Creation

• FOSSBilling
• Broken access control

FOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Access to Privileged Admin Functions

• FOSSBilling
• Information disclosure
• Authentication bypass

FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE

• FOSSBilling
• Code injection

FOSSBilling's password reset confirmation endpoint lacks rate limiting

• FOSSBilling
• Authentication bypass
• CWE-204

FOSSBilling has an open redirect via administrator-configured redirect targets

• FOSSBilling
• Open redirect

FOSSBilling version exposed via asset cache buster

• FOSSBilling
• Information disclosure