What’s Vulnerable › Vulnerabilities

CVE-2026-33734: FOSSBilling has improper SQL neutralization in `Massmailer` recipient filters

• Severity: medium (CVSS 6.9 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-06 · updated 2026-07-07
• Weakness: CWE-89

Description

FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have a SQL injection vulnerability in the `Massmailer` module filter functionality. An authenticated administrator can supply crafted filter values when updating a mass email message, causing untrusted input to be interpolated directly into SQL in the recipient selection query. Version 0.8.0 patches the issue. Some workarounds are available. Restrict administrator access to trusted users only, disable the `Massmailer` module if it is not required, audit existing records in the `mod_massmailer` table for suspicious filter values, and/or review administrator activity related to `Massmailer` message updates.

Affected products

• FOSSBilling: from 0.6.0, < 0.8.0

References

• https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-jf7m-j359-2899
• https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-jf7m-j359-2899

Get alerted when CVE-2026-33734 or the next vulnerability affects your stack