// CVE Research
Assigned CVEs
Vulnerabilities I discovered through source code review, responsibly disclosed to vendors, and received CVE assignments for.
4
CVEs Assigned
4
In Progress
1
High Severity
3
Moderate Severity
Published
CVE-2026-111055 MODERATE
Concurrent Checkouts Reuse a once-per-client Promo Code Unlimited Times
A once_per_client promo validates eligibility with a non-atomic COUNT query and writes the redemption row much later with no lock or unique constraint. Concurrent POST /api/client/cart/checkout requests all read zero and pass, so one client can redeem a single-use-per-client code on many orders — free provisioning or draining a finite global pool.
Published 2026-10-28
GHSA-qpq2-vvh9-hwfw
→
CVE-2026-43921 HIGH
Arbitrary PHP Code Injection via Unescaped Config Serialization → Remote Code Execution
FOSSBilling serializes config values into a PHP file using string interpolation with no escaping. A single quote in any string value breaks out of the PHP string literal, injecting arbitrary code that executes on every subsequent HTTP request as www-data.
Published 2026-06-11
GHSA-v4j9-w6pj-38w5
→
CVE-2026-43925 MODERATE
Mass Assignment of group_id in Guest Registration Allows Unauthorized Promo Code Use
The public registration endpoint passes the full request body into the internal client creation method without stripping admin-only fields. An unauthenticated attacker can supply a group_id to assign themselves to any client group and access group-restricted promo codes.
Published 2026-06-04
GHSA-q4rq-9844-r9w2
→
CVE-2026-43927 MODERATE
Race Condition in Cart Checkout Bypasses Promo Code Usage Limits
FOSSBilling's promo usage check and increment are non-atomic — three separate operations with no database locking. Concurrent checkout requests all read the same stale counter, all pass, and all create discounted orders. A single-use code can be exploited unlimited times.
Published 2026-06-04
GHSA-w898-cx35-25gh
→
In Progress
Akaunting ≤ 3.1.21 Awaiting CVE
Settings Namespace Injection → proc_open() RCE via sendmail_path Poisoning
Injecting into the email settings namespace via _prefix parameter rewrites sendmail_path with shell metacharacters. Triggers on any outbound email. CVSS 9.9.
Awaiting vendor
InvoiceNinja v5.13.19 Awaiting CVE
SSRF via SMTP Check Endpoint — Internal Port Oracle
The SMTP test endpoint accepts an attacker-controlled host with no RFC1918 filtering, turning it into an internal network scanner that leaks service state via response timing and error messages.
Awaiting vendor
Graylog ≤ 7.1.7 Awaiting CVE
SSRF via URL Allowlist Redirect Bypass → Internal OpenSearch & Metadata Access
The URL allowlist is validated once against the configured URL, then OkHttp follows 3xx redirects without re-checking each hop. An allowlisted or open-redirect host can pivot the server's requests into internal services, reading stored logs from an unauthenticated OpenSearch cluster or exfiltrating cloud instance-role credentials via IMDS. CVSS 9.9 Critical.
Reported 2026-08
GHSA-73c3-3q9x-5wq3
In triage
Graylog ≤ 7.1.7 Awaiting CVE
Unauthenticated Decompression Bomb DoS in the Beats Input
The Beats frame decoder bounds every frame type it handles except the compressed one, which inflates with no size limit. A modest concurrent burst of small zlib payloads drives a sustained OutOfMemoryError storm and JVM-wide GC stalls, denying Beats ingestion with no authentication required.
Reported 2026-08
GHSA-6r58-hv2p-fgx2
In triage