CVE-2026-108107criticalCWE-89

CVE-2026-108107: critical vulnerability in hotspotbilling phpnuxbill

PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.php

Published

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.3epss 0.4%
exploitation probability
0.4%top 66% of all CVEs
observed exploitation
nono source reports it
PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to extract customer records and credentials via time-based blind SQL injection.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
hotspotbilling · phpnuxbill
Related CVEs — hotspotbilling phpnuxbill

In the same product, most dangerous first.

CVE-2026-108109CRITICALPHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset CodeEPSS 0.4%CVE-2026-108108HIGHPHPNuxBill through 2025.3.20 CHAP Authentication Bypass via Password::chap_verify()EPSS 0.2%
References
https://github.com/hotspotbilling/phpnuxbillhttps://github.com/hotspotbilling/phpnuxbill/blob/2025.3.13/radius.php#L277https://github.com/hotspotbilling/phpnuxbill/security/advisories/GHSA-q8ch-r8cv-q579https://www.vulncheck.com/advisories/phpnuxbill-through-2025.3.20-unauthenticated-sql-injection-via-radius-php