agentprime: fossbillingEvery new CVE for fossbilling.https://agentprime.io/CVE-2026-111048: FOSSBilling: Low-privileged staff can run JavaScript in administrators' browsers via stored XSS in support ticket noteshttps://agentprime.io/advisories/CVE-2026-111048/https://agentprime.io/advisories/CVE-2026-111048/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 17:46:11 GMTCVECVE-2026-112374: FOSSBilling before 0.8.9 Login CSRF via Staff Guest Login APIhttps://agentprime.io/advisories/CVE-2026-112374/https://agentprime.io/advisories/CVE-2026-112374/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 12:10:37 GMTCVECVE-2026-111056: FOSSBilling: Unauthenticated client account enumeration via guest signup endpointhttps://agentprime.io/advisories/CVE-2026-111056/https://agentprime.io/advisories/CVE-2026-111056/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 16:00:57 GMTCVECVE-2026-111053: FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_existshttps://agentprime.io/advisories/CVE-2026-111053/https://agentprime.io/advisories/CVE-2026-111053/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 15:54:17 GMTCVECVE-2026-111046: FOSSBilling: Low-privileged staff can read and modify configuration of deactivated extensionshttps://agentprime.io/advisories/CVE-2026-111046/https://agentprime.io/advisories/CVE-2026-111046/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 15:49:48 GMTCVECVE-2026-53648: FOSSBilling: Downloadable product files can be overwritten through filename collisionshttps://agentprime.io/advisories/CVE-2026-53648/https://agentprime.io/advisories/CVE-2026-53648/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 06 Jul 2026 23:12:09 GMTCVECVE-2026-53647: FOSSBilling vulnerable to unauthenticated API key configuration disclosure via guest Serviceapikey get_info endpointhttps://agentprime.io/advisories/CVE-2026-53647/https://agentprime.io/advisories/CVE-2026-53647/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 06 Jul 2026 23:10:29 GMTCVECVE-2026-53646: FOSSBilling: Client password reset token reuse allows persistent account takeoverhttps://agentprime.io/advisories/CVE-2026-53646/https://agentprime.io/advisories/CVE-2026-53646/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 06 Jul 2026 22:58:10 GMTCVECVE-2026-53645: FOSSBilling's missing self-edit prevention in staff permission management allows persistent privilege escalationhttps://agentprime.io/advisories/CVE-2026-53645/https://agentprime.io/advisories/CVE-2026-53645/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 06 Jul 2026 22:55:56 GMTCVECVE-2026-53644: FOSSBilling's missing order-state validation allows clients to read and reset API key secrets for non-active ordershttps://agentprime.io/advisories/CVE-2026-53644/https://agentprime.io/advisories/CVE-2026-53644/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 06 Jul 2026 22:51:39 GMTCVECVE-2026-53643: FOSSBilling allows low-privileged staff accounts to perform unauthorized actions via admin API endpointshttps://agentprime.io/advisories/CVE-2026-53643/https://agentprime.io/advisories/CVE-2026-53643/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 06 Jul 2026 22:49:50 GMTCVECVE-2026-53642: FOSSBilling: Unverified clients can access client-area pages when email confirmation is requiredhttps://agentprime.io/advisories/CVE-2026-53642/https://agentprime.io/advisories/CVE-2026-53642/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 06 Jul 2026 22:45:51 GMTCVECVE-2026-53641: FOSSBilling has stored XSS in client email views via unescaped content in JavaScript template literalhttps://agentprime.io/advisories/CVE-2026-53641/https://agentprime.io/advisories/CVE-2026-53641/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 06 Jul 2026 22:36:38 GMTCVECVE-2026-53640: FOSSBilling missing authorization checks on read-only admin API endpoints expose sensitive staff, client, and redirect datahttps://agentprime.io/advisories/CVE-2026-53640/https://agentprime.io/advisories/CVE-2026-53640/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 06 Jul 2026 22:30:48 GMTCVECVE-2026-43928: FOSSBilling: Payment amount not validated in PayPalEmail adapter allows invoice underpaymenthttps://agentprime.io/advisories/CVE-2026-43928/https://agentprime.io/advisories/CVE-2026-43928/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 06 Jul 2026 21:53:31 GMTCVECVE-2026-43927: FOSSBilling has race condition in cart checkout that bypasses promo code usage limitshttps://agentprime.io/advisories/CVE-2026-43927/https://agentprime.io/advisories/CVE-2026-43927/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 06 Jul 2026 21:49:26 GMTCVECVE-2026-43925: FOSSBilling: Mass assignment of group_id in guest client registration allows unauthorized promo code usehttps://agentprime.io/advisories/CVE-2026-43925/https://agentprime.io/advisories/CVE-2026-43925/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 06 Jul 2026 21:41:00 GMTCVECVE-2026-43921: FOSSBilling vulnerable to arbitrary PHP code injection via unescaped config serializationhttps://agentprime.io/advisories/CVE-2026-43921/https://agentprime.io/advisories/CVE-2026-43921/CVSS 8.9 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 06 Jul 2026 21:38:49 GMTCVECVE-2026-43918: Suspended or inactive FOSSBilling accounts can retain or regain access through existing sessions, API tokens, and password reset flowshttps://agentprime.io/advisories/CVE-2026-43918/https://agentprime.io/advisories/CVE-2026-43918/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 06 Jul 2026 21:18:31 GMTCVECVE-2026-42331: FOSSBilling missing authorization in guest Invoice API endpointshttps://agentprime.io/advisories/CVE-2026-42331/https://agentprime.io/advisories/CVE-2026-42331/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 06 Jul 2026 21:00:07 GMTCVECVE-2026-33734: FOSSBilling has improper SQL neutralization in `Massmailer` recipient filtershttps://agentprime.io/advisories/CVE-2026-33734/https://agentprime.io/advisories/CVE-2026-33734/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 06 Jul 2026 20:56:26 GMTCVECVE-2026-42341: FOSSBilling has an unauthenticated payment bypass via IPN callback forgeryhttps://agentprime.io/advisories/CVE-2026-42341/https://agentprime.io/advisories/CVE-2026-42341/CVSS 9.2 (Critical). Critical: CVSS score 9.2: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 06 Jul 2026 20:53:21 GMTCVEcriticalCVE-2026-43920: FOSSBilling: Unauthenticated update patcher endpoint allows remote maintenance executionhttps://agentprime.io/advisories/CVE-2026-43920/https://agentprime.io/advisories/CVE-2026-43920/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 25 Jun 2026 23:06:43 GMTCVECVE-2026-33543: FOSSBilling: Authentication bypass allows unauthenticated administrator creationhttps://agentprime.io/advisories/CVE-2026-33543/https://agentprime.io/advisories/CVE-2026-33543/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 24 Jun 2026 21:01:16 GMTCVEcriticalCVE-2026-27708: FOSSBilling: IDOR in Servicecustom Client API allows cross-client data accesshttps://agentprime.io/advisories/CVE-2026-27708/https://agentprime.io/advisories/CVE-2026-27708/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 24 Jun 2026 19:24:50 GMTCVECVE-2026-23513: FOSSBilling: Broken Authorization in Client Transaction and Order Listingshttps://agentprime.io/advisories/CVE-2026-23513/https://agentprime.io/advisories/CVE-2026-23513/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 23 Jun 2026 20:11:41 GMTCVECVE-2025-64105: FOSSBilling: IDOR Vulnerability in Support Ticket Creationhttps://agentprime.io/advisories/CVE-2025-64105/https://agentprime.io/advisories/CVE-2025-64105/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 23 Jun 2026 19:45:32 GMTCVECVE-2026-27604: FOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Access to Privileged Admin Functionshttps://agentprime.io/advisories/CVE-2026-27604/https://agentprime.io/advisories/CVE-2026-27604/CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 23 Jun 2026 14:25:20 GMTCVEcriticalCVE-2026-28496: FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCEhttps://agentprime.io/advisories/CVE-2026-28496/https://agentprime.io/advisories/CVE-2026-28496/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 23 Jun 2026 14:20:50 GMTCVEcriticalCVE-2026-43926: FOSSBilling's password reset confirmation endpoint lacks rate limitinghttps://agentprime.io/advisories/CVE-2026-43926/https://agentprime.io/advisories/CVE-2026-43926/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 04 Jun 2026 12:46:30 GMTCVECVE-2026-43924: FOSSBilling has an open redirect via administrator-configured redirect targetshttps://agentprime.io/advisories/CVE-2026-43924/https://agentprime.io/advisories/CVE-2026-43924/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 03 Jun 2026 19:56:25 GMTCVECVE-2026-40495: FOSSBilling version exposed via asset cache busterhttps://agentprime.io/advisories/CVE-2026-40495/https://agentprime.io/advisories/CVE-2026-40495/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 03 Jun 2026 19:38:28 GMTCVE