Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-108108

PHPNuxBill through 2025.3.20 CHAP Authentication Bypass via Password::chap_verify()

PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in RADIUS CHAP verification because Password::chap_verify() returns true when the supplied response does not match. Attackers who know a valid customer or PPPoE username can log in through MikroTik hotspot or PPPoE CHAP with any incorrect password to obtain network access and consume that customer's plan.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Hotspotbilling
Products
Phpnuxbill
CVE-2026-108107

PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.php

PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to extract customer records and credentials via time-based blind SQL injection.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Hotspotbilling
Products
Phpnuxbill
CVE-2026-108109

PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code

PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code. Attackers knowing a customer username can guess the code without attempt limits or lockout, then read the newly set password from the HTTP response to hijack the account.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Hotspotbilling
Products
Phpnuxbill