Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-108109 (GCVE-0-2026-108109)

Vulnerability from nvd – Published: 2026-10-09 14:33 – Updated: 2026-10-09 17:26

Title

PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code

Summary

PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code. Attackers knowing a customer username can guess the code without attempt limits or lockout, then read the newly set password from the HTTP response to hijack the account.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-09 17:25 UTC

CWE

CWE-307 - Improper Restriction of Excessive Authentication Attempts

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 5277 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/hotspotbilling/phpnuxbill/secu…	vendor-advisory
https://github.com/hotspotbilling/phpnuxbill/comm…	patch
https://github.com/hotspotbilling/phpnuxbill/blob…	technical-description
https://github.com/hotspotbilling/phpnuxbill	product
https://www.vulncheck.com/advisories/phpnuxbill-t…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
hotspotbilling	phpnuxbill	Affected: 0 , ≤ 2025.3.20 (custom)

Date Public

2026-08-06 00:00

Credits

tonghuaroot leediay153 from Viettel Post

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-108109",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-09T17:25:00.595911Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-09T17:26:03.792Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/hotspotbilling/phpnuxbill/security/advisories/GHSA-337r-rrrc-r559"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "phpnuxbill",
          "vendor": "hotspotbilling",
          "versions": [
            {
              "lessThanOrEqual": "2025.3.20",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "tonghuaroot"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "leediay153 from Viettel Post"
        }
      ],
      "datePublic": "2026-08-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code. Attackers knowing a customer username can guess the code without attempt limits or lockout, then read the newly set password from the HTTP response to hijack the account."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-307",
              "description": "Improper Restriction of Excessive Authentication Attempts",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T14:33:32.201Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-337r-rrrc-r559)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/hotspotbilling/phpnuxbill/security/advisories/GHSA-337r-rrrc-r559"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/hotspotbilling/phpnuxbill/commit/c3c2a92d468af91136d747b75142ed72f10320cc"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/hotspotbilling/phpnuxbill/blob/2025.3.13/system/controllers/forgot.php#L41"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/hotspotbilling/phpnuxbill"
        },
        {
          "name": "VulnCheck Advisory: PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/phpnuxbill-through-2025.3.20-account-takeover-via-brute-forceable-password-reset-code"
        }
      ],
      "title": "PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-108109",
    "datePublished": "2026-10-09T14:33:32.201Z",
    "dateReserved": "2026-10-09T13:44:40.883Z",
    "dateUpdated": "2026-10-09T17:26:03.792Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108108 (GCVE-0-2026-108108)

Vulnerability from nvd – Published: 2026-10-09 14:33 – Updated: 2026-10-09 14:33

Title

PHPNuxBill through 2025.3.20 CHAP Authentication Bypass via Password::chap_verify()

Summary

PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in RADIUS CHAP verification because Password::chap_verify() returns true when the supplied response does not match. Attackers who know a valid customer or PPPoE username can log in through MikroTik hotspot or PPPoE CHAP with any incorrect password to obtain network access and consume that customer's plan.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

7.1 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

CWE

CWE-287 - Improper Authentication

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 5277 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/hotspotbilling/phpnuxbill/secu…	vendor-advisory
https://github.com/hotspotbilling/phpnuxbill/blob…	technical-description
https://github.com/hotspotbilling/phpnuxbill	product
https://www.vulncheck.com/advisories/phpnuxbill-t…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
hotspotbilling	phpnuxbill	Affected: 0 , ≤ 2025.3.20 (custom)

Date Public

2026-08-06 00:00

Credits

kitu232 leediay153 from Viettel Post

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "phpnuxbill",
          "vendor": "hotspotbilling",
          "versions": [
            {
              "lessThanOrEqual": "2025.3.20",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "kitu232"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "leediay153 from Viettel Post"
        }
      ],
      "datePublic": "2026-08-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in RADIUS CHAP verification because Password::chap_verify() returns true when the supplied response does not match. Attackers who know a valid customer or PPPoE username can log in through MikroTik hotspot or PPPoE CHAP with any incorrect password to obtain network access and consume that customer\u0027s plan."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T14:33:31.585Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-6f62-x25v-9686)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/hotspotbilling/phpnuxbill/security/advisories/GHSA-6f62-x25v-9686"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/hotspotbilling/phpnuxbill/blob/2025.3.13/system/autoload/Password.php#L48"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/hotspotbilling/phpnuxbill"
        },
        {
          "name": "VulnCheck Advisory: PHPNuxBill through 2025.3.20 CHAP Authentication Bypass via Password::chap_verify()",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/phpnuxbill-through-2025.3.20-chap-authentication-bypass-via-password-chap-verify"
        }
      ],
      "title": "PHPNuxBill through 2025.3.20 CHAP Authentication Bypass via Password::chap_verify()",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-108108",
    "datePublished": "2026-10-09T14:33:31.585Z",
    "dateReserved": "2026-10-09T13:44:40.883Z",
    "dateUpdated": "2026-10-09T14:33:31.585Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108107 (GCVE-0-2026-108107)

Vulnerability from nvd – Published: 2026-10-09 14:33 – Updated: 2026-10-09 14:46

Title

PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.php

Summary

PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to extract customer records and credentials via time-based blind SQL injection.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-09 14:46 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 5277 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/hotspotbilling/phpnuxbill/secu…	vendor-advisory
https://github.com/hotspotbilling/phpnuxbill/blob…	technical-description
https://github.com/hotspotbilling/phpnuxbill	product
https://www.vulncheck.com/advisories/phpnuxbill-t…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
hotspotbilling	phpnuxbill	Affected: 0 , ≤ 2025.3.20 (custom)

Date Public

2026-08-06 00:00

Credits

kitu232 leediay153 from Viettel Post

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-108107",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-09T14:46:45.760913Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-09T14:46:56.077Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/hotspotbilling/phpnuxbill/security/advisories/GHSA-q8ch-r8cv-q579"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "phpnuxbill",
          "vendor": "hotspotbilling",
          "versions": [
            {
              "lessThanOrEqual": "2025.3.20",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "kitu232"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "leediay153 from Viettel Post"
        }
      ],
      "datePublic": "2026-08-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to extract customer records and credentials via time-based blind SQL injection."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T14:33:30.389Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-q8ch-r8cv-q579)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/hotspotbilling/phpnuxbill/security/advisories/GHSA-q8ch-r8cv-q579"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/hotspotbilling/phpnuxbill/blob/2025.3.13/radius.php#L277"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/hotspotbilling/phpnuxbill"
        },
        {
          "name": "VulnCheck Advisory: PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.php",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/phpnuxbill-through-2025.3.20-unauthenticated-sql-injection-via-radius-php"
        }
      ],
      "title": "PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.php",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-108107",
    "datePublished": "2026-10-09T14:33:30.389Z",
    "dateReserved": "2026-10-09T13:44:40.883Z",
    "dateUpdated": "2026-10-09T14:46:56.077Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108109 (GCVE-0-2026-108109)

Vulnerability from cvelistv5 – Published: 2026-10-09 14:33 – Updated: 2026-10-09 17:26

Title

PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code

Summary

PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code. Attackers knowing a customer username can guess the code without attempt limits or lockout, then read the newly set password from the HTTP response to hijack the account.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-09 17:25 UTC

CWE

CWE-307 - Improper Restriction of Excessive Authentication Attempts

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 5277 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/hotspotbilling/phpnuxbill/secu…	vendor-advisory
https://github.com/hotspotbilling/phpnuxbill/comm…	patch
https://github.com/hotspotbilling/phpnuxbill/blob…	technical-description
https://github.com/hotspotbilling/phpnuxbill	product
https://www.vulncheck.com/advisories/phpnuxbill-t…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
hotspotbilling	phpnuxbill	Affected: 0 , ≤ 2025.3.20 (custom)

Date Public

2026-08-06 00:00

Credits

tonghuaroot leediay153 from Viettel Post

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-108109",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-09T17:25:00.595911Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-09T17:26:03.792Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/hotspotbilling/phpnuxbill/security/advisories/GHSA-337r-rrrc-r559"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "phpnuxbill",
          "vendor": "hotspotbilling",
          "versions": [
            {
              "lessThanOrEqual": "2025.3.20",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "tonghuaroot"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "leediay153 from Viettel Post"
        }
      ],
      "datePublic": "2026-08-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code. Attackers knowing a customer username can guess the code without attempt limits or lockout, then read the newly set password from the HTTP response to hijack the account."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-307",
              "description": "Improper Restriction of Excessive Authentication Attempts",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T14:33:32.201Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-337r-rrrc-r559)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/hotspotbilling/phpnuxbill/security/advisories/GHSA-337r-rrrc-r559"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/hotspotbilling/phpnuxbill/commit/c3c2a92d468af91136d747b75142ed72f10320cc"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/hotspotbilling/phpnuxbill/blob/2025.3.13/system/controllers/forgot.php#L41"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/hotspotbilling/phpnuxbill"
        },
        {
          "name": "VulnCheck Advisory: PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/phpnuxbill-through-2025.3.20-account-takeover-via-brute-forceable-password-reset-code"
        }
      ],
      "title": "PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-108109",
    "datePublished": "2026-10-09T14:33:32.201Z",
    "dateReserved": "2026-10-09T13:44:40.883Z",
    "dateUpdated": "2026-10-09T17:26:03.792Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108108 (GCVE-0-2026-108108)

Vulnerability from cvelistv5 – Published: 2026-10-09 14:33 – Updated: 2026-10-09 14:33

Title

PHPNuxBill through 2025.3.20 CHAP Authentication Bypass via Password::chap_verify()

Summary

PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in RADIUS CHAP verification because Password::chap_verify() returns true when the supplied response does not match. Attackers who know a valid customer or PPPoE username can log in through MikroTik hotspot or PPPoE CHAP with any incorrect password to obtain network access and consume that customer's plan.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

7.1 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

CWE

CWE-287 - Improper Authentication

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 5277 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/hotspotbilling/phpnuxbill/secu…	vendor-advisory
https://github.com/hotspotbilling/phpnuxbill/blob…	technical-description
https://github.com/hotspotbilling/phpnuxbill	product
https://www.vulncheck.com/advisories/phpnuxbill-t…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
hotspotbilling	phpnuxbill	Affected: 0 , ≤ 2025.3.20 (custom)

Date Public

2026-08-06 00:00

Credits

kitu232 leediay153 from Viettel Post

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "phpnuxbill",
          "vendor": "hotspotbilling",
          "versions": [
            {
              "lessThanOrEqual": "2025.3.20",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "kitu232"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "leediay153 from Viettel Post"
        }
      ],
      "datePublic": "2026-08-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in RADIUS CHAP verification because Password::chap_verify() returns true when the supplied response does not match. Attackers who know a valid customer or PPPoE username can log in through MikroTik hotspot or PPPoE CHAP with any incorrect password to obtain network access and consume that customer\u0027s plan."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T14:33:31.585Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-6f62-x25v-9686)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/hotspotbilling/phpnuxbill/security/advisories/GHSA-6f62-x25v-9686"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/hotspotbilling/phpnuxbill/blob/2025.3.13/system/autoload/Password.php#L48"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/hotspotbilling/phpnuxbill"
        },
        {
          "name": "VulnCheck Advisory: PHPNuxBill through 2025.3.20 CHAP Authentication Bypass via Password::chap_verify()",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/phpnuxbill-through-2025.3.20-chap-authentication-bypass-via-password-chap-verify"
        }
      ],
      "title": "PHPNuxBill through 2025.3.20 CHAP Authentication Bypass via Password::chap_verify()",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-108108",
    "datePublished": "2026-10-09T14:33:31.585Z",
    "dateReserved": "2026-10-09T13:44:40.883Z",
    "dateUpdated": "2026-10-09T14:33:31.585Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108107 (GCVE-0-2026-108107)

Vulnerability from cvelistv5 – Published: 2026-10-09 14:33 – Updated: 2026-10-09 14:46

Title

PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.php

Summary

PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to extract customer records and credentials via time-based blind SQL injection.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-09 14:46 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 5277 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/hotspotbilling/phpnuxbill/secu…	vendor-advisory
https://github.com/hotspotbilling/phpnuxbill/blob…	technical-description
https://github.com/hotspotbilling/phpnuxbill	product
https://www.vulncheck.com/advisories/phpnuxbill-t…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
hotspotbilling	phpnuxbill	Affected: 0 , ≤ 2025.3.20 (custom)

Date Public

2026-08-06 00:00

Credits

kitu232 leediay153 from Viettel Post

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-108107",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-09T14:46:45.760913Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-09T14:46:56.077Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/hotspotbilling/phpnuxbill/security/advisories/GHSA-q8ch-r8cv-q579"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "phpnuxbill",
          "vendor": "hotspotbilling",
          "versions": [
            {
              "lessThanOrEqual": "2025.3.20",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "kitu232"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "leediay153 from Viettel Post"
        }
      ],
      "datePublic": "2026-08-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to extract customer records and credentials via time-based blind SQL injection."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T14:33:30.389Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-q8ch-r8cv-q579)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/hotspotbilling/phpnuxbill/security/advisories/GHSA-q8ch-r8cv-q579"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/hotspotbilling/phpnuxbill/blob/2025.3.13/radius.php#L277"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/hotspotbilling/phpnuxbill"
        },
        {
          "name": "VulnCheck Advisory: PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.php",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/phpnuxbill-through-2025.3.20-unauthenticated-sql-injection-via-radius-php"
        }
      ],
      "title": "PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.php",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-108107",
    "datePublished": "2026-10-09T14:33:30.389Z",
    "dateReserved": "2026-10-09T13:44:40.883Z",
    "dateUpdated": "2026-10-09T14:46:56.077Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

6 vulnerabilities by hotspotbilling

CVE-2026-108109 (GCVE-0-2026-108109)

CVE-2026-108108 (GCVE-0-2026-108108)

CVE-2026-108107 (GCVE-0-2026-108107)

CVE-2026-108109 (GCVE-0-2026-108109)

CVE-2026-108108 (GCVE-0-2026-108108)

CVE-2026-108107 (GCVE-0-2026-108107)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

6 vulnerabilities by hotspotbilling

CVE-2026-108109 (GCVE-0-2026-108109)

CVE-2026-108108 (GCVE-0-2026-108108)

CVE-2026-108107 (GCVE-0-2026-108107)

CVE-2026-108109 (GCVE-0-2026-108109)

CVE-2026-108108 (GCVE-0-2026-108108)

CVE-2026-108107 (GCVE-0-2026-108107)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.