Threat database

PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code. Attackers knowing a customer username can guess the code without attempt limits or lockout, then read the newly set password from the HTTP response to hijack the account.

CVE-2026-108108 is an authentication bypass vulnerability in PHPNuxBill through version 2025.3.20. The flaw exists in the RADIUS CHAP verification process where Password::chap_verify() incorrectly returns true even when the supplied response does not match the expected value. This allows attackers who know a valid customer or PPPoE username to log in via MikroTik hotspot or PPPoE CHAP with any incorrect password, gaining unauthorized network access and potentially consuming that customer's plan.

PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to extract customer records and credentials via time-based blind SQL injection.