Threat Intelligence Database
Comprehensive database of the latest cyber threats affecting organizations worldwide. Filter and search to find specific threat intelligence relevant to your organization.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threat Intelligence
Click on any threat for detailed analysis and mitigation recommendations
0 PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code. Attackers knowing a customer username can guess the code without attempt limits or lockout, then read the newly set password from the HTTP response to hijack the account. Join the discussion | CVE Database V5 | 10/09/2026, 14:33:32 UTC Added: 10/09/2026, 14:49:12 UTC |
CVE-2026-108108 is an authentication bypass vulnerability in PHPNuxBill up to version 2025.3.20. The flaw exists in the RADIUS CHAP verification process where Password::chap_verify() incorrectly returns true even when the supplied response does not match. This allows attackers who know a valid username to log in with any incorrect password via MikroTik hotspot or PPPoE CHAP, gaining unauthorized network access and consuming the victim's plan. Join the discussion | CVE Database V5 | 10/09/2026, 14:33:31 UTC Added: 10/09/2026, 14:49:12 UTC |
0 PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to extract customer records and credentials via time-based blind SQL injection. Join the discussion | CVE Database V5 | 10/09/2026, 14:33:30 UTC Added: 10/09/2026, 14:49:12 UTC |
Showing 1 to 3 of 3 results