Skip to content
OpenAdvisories

Vendor

hotspotbilling

3 known vulnerabilities.

Products

phpnuxbill 3
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-108109

    PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code

    PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code. Attackers knowing a customer username can g…

    hotspotbilling phpnuxbill
  • Critical 9.8
    CVE-2026-108107

    PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.php

    PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to t…

    hotspotbilling phpnuxbill