{"schema_version":1,"title":"FOSSBilling vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 27 vulnerabilities in FOSSBilling: 0 in the last 7 days and 17 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-53648, was published on 7 July 2026. 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/fossbilling","json_url":"https://junglewise.ai/threats/vendors/fossbilling.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/fossbilling","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":0,"all_time":27,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":17,"last_365_days":27},"latest":[{"cve":"CVE-2026-53648","cvss":5.1,"slug":"cve-2026-53648-fossbilling-file-overwrite-via-filename-collision-in-downloadable","title":"FOSSBilling file overwrite via filename collision in downloadable products","severity":"info","exploited":false,"published_at":"2026-07-07T00:16:34.39+00:00","url":"https://junglewise.ai/threats/cve-2026-53648-fossbilling-file-overwrite-via-filename-collision-in-downloadable"},{"cve":"CVE-2026-53647","cvss":6.9,"slug":"cve-2026-53647-fossbilling-information-disclosure-in-guest-serviceapikey-get","title":"FOSSBilling information disclosure in Guest serviceapikey/get_info API","severity":"info","exploited":false,"published_at":"2026-07-07T00:16:34.263+00:00","url":"https://junglewise.ai/threats/cve-2026-53647-fossbilling-information-disclosure-in-guest-serviceapikey-get"},{"cve":"CVE-2026-53646","cvss":7.7,"slug":"cve-2026-53646-fossbilling-weak-password-recovery-mechanism-in-client-api","title":"FOSSBilling weak password recovery mechanism in Client API","severity":"info","exploited":false,"published_at":"2026-07-06T23:16:56.683+00:00","url":"https://junglewise.ai/threats/cve-2026-53646-fossbilling-weak-password-recovery-mechanism-in-client-api"},{"cve":"CVE-2026-53645","cvss":8.5,"slug":"cve-2026-53645-fossbilling-privilege-escalation-in-staff-permission-management","title":"FOSSBilling privilege escalation in staff permission management","severity":"info","exploited":false,"published_at":"2026-07-06T23:16:56.493+00:00","url":"https://junglewise.ai/threats/cve-2026-53645-fossbilling-privilege-escalation-in-staff-permission-management"},{"cve":"CVE-2026-53644","cvss":8.6,"slug":"cve-2026-53644-fossbilling-authorization-bypass-in-serviceapikey-module","title":"FOSSBilling authorization bypass in Serviceapikey module","severity":"info","exploited":false,"published_at":"2026-07-06T23:16:56.36+00:00","url":"https://junglewise.ai/threats/cve-2026-53644-fossbilling-authorization-bypass-in-serviceapikey-module"},{"cve":"CVE-2026-53643","cvss":8.7,"slug":"cve-2026-53643-fossbilling-authorization-bypass-in-admin-api-endpoints","title":"FOSSBilling authorization bypass in admin API endpoints","severity":"info","exploited":false,"published_at":"2026-07-06T23:16:56.227+00:00","url":"https://junglewise.ai/threats/cve-2026-53643-fossbilling-authorization-bypass-in-admin-api-endpoints"},{"cve":"CVE-2026-53642","cvss":5.3,"slug":"cve-2026-53642-fossbilling-incorrect-authorization-in-client-area-access-control","title":"FOSSBilling incorrect authorization in client area access control","severity":"info","exploited":false,"published_at":"2026-07-06T23:16:56.097+00:00","url":"https://junglewise.ai/threats/cve-2026-53642-fossbilling-incorrect-authorization-in-client-area-access-control"},{"cve":"CVE-2026-53641","cvss":4.8,"slug":"cve-2026-53641-fossbilling-stored-xss-in-client-email-history-views","title":"FOSSBilling stored XSS in client email history views","severity":"info","exploited":false,"published_at":"2026-07-06T23:16:55.967+00:00","url":"https://junglewise.ai/threats/cve-2026-53641-fossbilling-stored-xss-in-client-email-history-views"},{"cve":"CVE-2026-53640","cvss":2.3,"slug":"cve-2026-53640-fossbilling-missing-authorization-in-admin-api-read-endpoints","title":"FOSSBilling missing authorization in admin API read endpoints","severity":"info","exploited":false,"published_at":"2026-07-06T23:16:55.43+00:00","url":"https://junglewise.ai/threats/cve-2026-53640-fossbilling-missing-authorization-in-admin-api-read-endpoints"},{"cve":"CVE-2026-43928","cvss":2.3,"slug":"cve-2026-43928-fossbilling-invoice-underpayment-in-paypalemail-adapter","title":"FOSSBilling invoice underpayment in PayPalEmail adapter","severity":"info","exploited":false,"published_at":"2026-07-06T22:16:50.21+00:00","url":"https://junglewise.ai/threats/cve-2026-43928-fossbilling-invoice-underpayment-in-paypalemail-adapter"},{"cve":"CVE-2026-43927","cvss":6.9,"slug":"cve-2026-43927-fossbilling-race-condition-in-cart-checkout-promo-code-validation","title":"FOSSBilling race condition in cart checkout promo code validation","severity":"info","exploited":false,"published_at":"2026-07-06T22:16:50.083+00:00","url":"https://junglewise.ai/threats/cve-2026-43927-fossbilling-race-condition-in-cart-checkout-promo-code-validation"},{"cve":"CVE-2026-43925","cvss":6.9,"slug":"cve-2026-43925-fossbilling-mass-assignment-in-client-self-registration","title":"FOSSBilling mass assignment in client self-registration","severity":"info","exploited":false,"published_at":"2026-07-06T22:16:49.963+00:00","url":"https://junglewise.ai/threats/cve-2026-43925-fossbilling-mass-assignment-in-client-self-registration"},{"cve":"CVE-2026-43921","cvss":8.9,"slug":"cve-2026-43921-fossbilling-php-code-injection-in-config-component","title":"FOSSBilling PHP code injection in Config component","severity":"info","exploited":false,"published_at":"2026-07-06T22:16:49.837+00:00","url":"https://junglewise.ai/threats/cve-2026-43921-fossbilling-php-code-injection-in-config-component"},{"cve":"CVE-2026-43918","cvss":8.7,"slug":"cve-2026-43918-fossbilling-insufficient-session-expiration-for-suspended","title":"FOSSBilling insufficient session expiration for suspended accounts","severity":"info","exploited":false,"published_at":"2026-07-06T22:16:49.707+00:00","url":"https://junglewise.ai/threats/cve-2026-43918-fossbilling-insufficient-session-expiration-for-suspended"},{"cve":"CVE-2026-42341","cvss":9.2,"slug":"cve-2026-42341-fossbilling-unauthenticated-payment-bypass-in-ipn-callback","title":"FOSSBilling unauthenticated payment bypass in IPN callback","severity":"info","exploited":false,"published_at":"2026-07-06T21:16:55.74+00:00","url":"https://junglewise.ai/threats/cve-2026-42341-fossbilling-unauthenticated-payment-bypass-in-ipn-callback"},{"cve":"CVE-2026-42331","cvss":7.7,"slug":"cve-2026-42331-fossbilling-missing-authorization-in-guest-api-invoice-endpoints","title":"FOSSBilling missing authorization in Guest API invoice endpoints","severity":"info","exploited":false,"published_at":"2026-07-06T21:16:55.617+00:00","url":"https://junglewise.ai/threats/cve-2026-42331-fossbilling-missing-authorization-in-guest-api-invoice-endpoints"},{"cve":"CVE-2026-33734","cvss":6.9,"slug":"cve-2026-33734-fossbilling-sql-injection-in-massmailer-module","title":"FOSSBilling SQL injection in Massmailer module","severity":"info","exploited":false,"published_at":"2026-07-06T21:16:55.227+00:00","url":"https://junglewise.ai/threats/cve-2026-33734-fossbilling-sql-injection-in-massmailer-module"},{"cve":"CVE-2026-43920","cvss":6.9,"slug":"cve-2026-43920-fossbilling-missing-authentication-in-run-patcher-endpoint","title":"FOSSBilling missing authentication in /run-patcher endpoint","severity":"info","exploited":false,"published_at":"2026-06-26T00:16:52.817+00:00","url":"https://junglewise.ai/threats/cve-2026-43920-fossbilling-missing-authentication-in-run-patcher-endpoint"},{"cve":"CVE-2026-33543","cvss":9.3,"slug":"cve-2026-33543-fossbilling-authentication-bypass-in-guest-staff-creation-api","title":"FOSSBilling authentication bypass in guest staff creation API","severity":"info","exploited":false,"published_at":"2026-06-24T21:16:53.453+00:00","url":"https://junglewise.ai/threats/cve-2026-33543-fossbilling-authentication-bypass-in-guest-staff-creation-api"},{"cve":"CVE-2026-27708","cvss":7.1,"slug":"cve-2026-27708-fossbilling-idor-in-servicecustom-client-api","title":"FOSSBilling IDOR in Servicecustom Client API","severity":"info","exploited":false,"published_at":"2026-06-24T20:16:31.963+00:00","url":"https://junglewise.ai/threats/cve-2026-27708-fossbilling-idor-in-servicecustom-client-api"},{"cve":"CVE-2026-23513","cvss":7.1,"slug":"cve-2026-23513-fossbilling-incorrect-authorization-in-client-transaction-and","title":"FOSSBilling incorrect authorization in client transaction and order listings","severity":"info","exploited":false,"published_at":"2026-06-23T21:16:55.203+00:00","url":"https://junglewise.ai/threats/cve-2026-23513-fossbilling-incorrect-authorization-in-client-transaction-and"},{"cve":"CVE-2025-64105","cvss":5.1,"slug":"cve-2025-64105-fossbilling-idor-in-support-ticket-creation","title":"FOSSBilling IDOR in support ticket creation","severity":"info","exploited":false,"published_at":"2026-06-23T21:16:53.927+00:00","url":"https://junglewise.ai/threats/cve-2025-64105-fossbilling-idor-in-support-ticket-creation"},{"cve":"CVE-2026-28496","cvss":9.4,"slug":"cve-2026-28496-fossbilling-server-side-template-injection-in-twig-rendering","title":"FOSSBilling Server-Side Template Injection in Twig rendering","severity":"info","exploited":false,"published_at":"2026-06-23T15:16:33.85+00:00","url":"https://junglewise.ai/threats/cve-2026-28496-fossbilling-server-side-template-injection-in-twig-rendering"},{"cve":"CVE-2026-27604","cvss":10,"slug":"cve-2026-27604-fossbilling-authorization-bypass-in-system-api-endpoints","title":"FOSSBilling authorization bypass in system API endpoints","severity":"info","exploited":false,"published_at":"2026-06-23T15:16:33.7+00:00","url":"https://junglewise.ai/threats/cve-2026-27604-fossbilling-authorization-bypass-in-system-api-endpoints"},{"cve":"CVE-2026-43926","cvss":6.3,"slug":"cve-2026-43926-fossbilling-missing-rate-limiting-in-password-reset-and-auth","title":"FOSSBilling missing rate limiting in password reset and auth endpoints","severity":"info","exploited":false,"published_at":"2026-06-04T14:16:41.193+00:00","url":"https://junglewise.ai/threats/cve-2026-43926-fossbilling-missing-rate-limiting-in-password-reset-and-auth"}],"vendor":{"hub":true,"name":"FOSSBilling","slug":"fossbilling","homepage":"https://fossbilling.org/","description":"An open-source community project providing a billing and client management solution for hosting providers.","url":"https://junglewise.ai/threats/vendors/fossbilling"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":17},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-27604","cvss":10,"slug":"cve-2026-27604-fossbilling-authorization-bypass-in-system-api-endpoints","title":"FOSSBilling authorization bypass in system API endpoints","severity":"info","exploited":false,"published_at":"2026-06-23T15:16:33.7+00:00","url":"https://junglewise.ai/threats/cve-2026-27604-fossbilling-authorization-bypass-in-system-api-endpoints"},{"cve":"CVE-2026-28496","cvss":9.4,"slug":"cve-2026-28496-fossbilling-server-side-template-injection-in-twig-rendering","title":"FOSSBilling Server-Side Template Injection in Twig rendering","severity":"info","exploited":false,"published_at":"2026-06-23T15:16:33.85+00:00","url":"https://junglewise.ai/threats/cve-2026-28496-fossbilling-server-side-template-injection-in-twig-rendering"},{"cve":"CVE-2026-33543","cvss":9.3,"slug":"cve-2026-33543-fossbilling-authentication-bypass-in-guest-staff-creation-api","title":"FOSSBilling authentication bypass in guest staff creation API","severity":"info","exploited":false,"published_at":"2026-06-24T21:16:53.453+00:00","url":"https://junglewise.ai/threats/cve-2026-33543-fossbilling-authentication-bypass-in-guest-staff-creation-api"},{"cve":"CVE-2026-42341","cvss":9.2,"slug":"cve-2026-42341-fossbilling-unauthenticated-payment-bypass-in-ipn-callback","title":"FOSSBilling unauthenticated payment bypass in IPN callback","severity":"info","exploited":false,"published_at":"2026-07-06T21:16:55.74+00:00","url":"https://junglewise.ai/threats/cve-2026-42341-fossbilling-unauthenticated-payment-bypass-in-ipn-callback"},{"cve":"CVE-2026-43921","cvss":8.9,"slug":"cve-2026-43921-fossbilling-php-code-injection-in-config-component","title":"FOSSBilling PHP code injection in Config component","severity":"info","exploited":false,"published_at":"2026-07-06T22:16:49.837+00:00","url":"https://junglewise.ai/threats/cve-2026-43921-fossbilling-php-code-injection-in-config-component"},{"cve":"CVE-2026-53643","cvss":8.7,"slug":"cve-2026-53643-fossbilling-authorization-bypass-in-admin-api-endpoints","title":"FOSSBilling authorization bypass in admin API endpoints","severity":"info","exploited":false,"published_at":"2026-07-06T23:16:56.227+00:00","url":"https://junglewise.ai/threats/cve-2026-53643-fossbilling-authorization-bypass-in-admin-api-endpoints"},{"cve":"CVE-2026-43918","cvss":8.7,"slug":"cve-2026-43918-fossbilling-insufficient-session-expiration-for-suspended","title":"FOSSBilling insufficient session expiration for suspended accounts","severity":"info","exploited":false,"published_at":"2026-07-06T22:16:49.707+00:00","url":"https://junglewise.ai/threats/cve-2026-43918-fossbilling-insufficient-session-expiration-for-suspended"},{"cve":"CVE-2026-53644","cvss":8.6,"slug":"cve-2026-53644-fossbilling-authorization-bypass-in-serviceapikey-module","title":"FOSSBilling authorization bypass in Serviceapikey module","severity":"info","exploited":false,"published_at":"2026-07-06T23:16:56.36+00:00","url":"https://junglewise.ai/threats/cve-2026-53644-fossbilling-authorization-bypass-in-serviceapikey-module"},{"cve":"CVE-2026-53645","cvss":8.5,"slug":"cve-2026-53645-fossbilling-privilege-escalation-in-staff-permission-management","title":"FOSSBilling privilege escalation in staff permission management","severity":"info","exploited":false,"published_at":"2026-07-06T23:16:56.493+00:00","url":"https://junglewise.ai/threats/cve-2026-53645-fossbilling-privilege-escalation-in-staff-permission-management"},{"cve":"CVE-2026-53646","cvss":7.7,"slug":"cve-2026-53646-fossbilling-weak-password-recovery-mechanism-in-client-api","title":"FOSSBilling weak password recovery mechanism in Client API","severity":"info","exploited":false,"published_at":"2026-07-06T23:16:56.683+00:00","url":"https://junglewise.ai/threats/cve-2026-53646-fossbilling-weak-password-recovery-mechanism-in-client-api"}],"generated_at":"2026-09-26T09:11:00.170868+00:00","technologies":[{"name":"FOSSBilling","slug":"fossbilling","vulnerabilities":27,"url":"https://junglewise.ai/threats/technologies/fossbilling"}]}