Skip to content
Threat Feed
Subscribe

Product

PHPNuxBill (<= 2025.3.20)

1 brief RSS
critical advisory

Unauthenticated SQL Injection in PHPNuxBill radius.php

PHPNuxBill versions through 2025.3.20 are vulnerable to an unauthenticated time-based blind SQL injection in the radius.php FreeRADIUS REST endpoint, allowing credential and data exfiltration.

PHPNuxBill web-application authentication-bypass account-takeover cve-2026-108108
2r 3t 1c