CVE-2026-33734— FOSSBilling has improper SQL neutralization in `Massmailer` recipient filters
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| FOSSBilling | FOSSBilling | >= 0.6.0, < 0.8.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-33734
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FOSSBilling has improper SQL neutralization in `Massmailer` recipient filters
Source: NVD (National Vulnerability Database)
Vulnerability Description
FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have a SQL injection vulnerability in the `Massmailer` module filter functionality. An authenticated administrator can supply crafted filter values when updating a mass email message, causing untrusted input to be interpolated directly into SQL in the recipient selection query. Version 0.8.0 patches the issue. Some workarounds are available. Restrict administrator access to trusted users only, disable the `Massmailer` module if it is not required, audit existing records in the `mod_massmailer` table for suspicious filter values, and/or review administrator activity related to `Massmailer` message updates.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| FOSSBilling | FOSSBilling | >= 0.6.0, < 0.8.0 | - |
II. Public POCs for CVE-2026-33734
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-33734
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-33734 (1)
Same Patch Batch · FOSSBilling · 2026-07-06 · 17 CVEs total
| CVE-2026-42341 | FOSSBilling has an unauthenticated payment bypass via IPN callback forgery | |
| CVE-2026-42331 | FOSSBilling missing authorization in guest Invoice API endpoints | |
| CVE-2026-43921 | FOSSBilling vulnerable to arbitrary PHP code injection via unescaped config serialization | |
| CVE-2026-43918 | Suspended or inactive FOSSBilling accounts can retain or regain access through existing se | |
| CVE-2026-43927 | FOSSBilling has race condition in cart checkout that bypasses promo code usage limits | |
| CVE-2026-43925 | FOSSBilling: Mass assignment of group_id in guest client registration allows unauthorized | |
| CVE-2026-43928 | FOSSBilling: Payment amount not validated in PayPalEmail adapter allows invoice underpayme | |
| CVE-2026-53640 | FOSSBilling missing authorization checks on read-only admin API endpoints expose sensitive | |
| CVE-2026-53641 | FOSSBilling has stored XSS in client email views via unescaped content in JavaScript templ | |
| CVE-2026-53645 | FOSSBilling's missing self-edit prevention in staff permission management allows persisten | |
| CVE-2026-53646 | FOSSBilling: Client password reset token reuse allows persistent account takeover | |
| CVE-2026-53643 | FOSSBilling allows low-privileged staff accounts to perform unauthorized actions via admin | |
| CVE-2026-53644 | FOSSBilling's missing order-state validation allows clients to read and reset API key secr | |
| CVE-2026-53642 | FOSSBilling: Unverified clients can access client-area pages when email confirmation is re | |
| CVE-2026-53647 | FOSSBilling vulnerable to unauthenticated API key configuration disclosure via guest Servi | |
| CVE-2026-53648 | FOSSBilling: Downloadable product files can be overwritten through filename collisions |
IV. Related Vulnerabilities
Same product: FOSSBilling
- CVE-2026-53648
FOSSBilling: Downloadable product files can be overwritten t - CVE-2026-53647
FOSSBilling vulnerable to unauthenticated API key configurat - CVE-2026-53646
FOSSBilling: Client password reset token reuse allows persis - CVE-2026-53645
FOSSBilling's missing self-edit prevention in staff permissi - CVE-2026-53644
FOSSBilling's missing order-state validation allows clients
Same vendor: FOSSBilling
- CVE-2026-53648
FOSSBilling: Downloadable product files can be overwritten t - CVE-2026-53647
FOSSBilling vulnerable to unauthenticated API key configurat - CVE-2026-53646
FOSSBilling: Client password reset token reuse allows persis - CVE-2026-53645
FOSSBilling's missing self-edit prevention in staff permissi - CVE-2026-53644
FOSSBilling's missing order-state validation allows clients
Same weakness: CWE-89
- CVE-2026-55635
DataEase: Authenticated SQL Injection in Chart Quota Filters - CVE-2026-14471
Authenticated SQL injection in the metrics-service retention - CVE-2026-14809
PROG MIS｜Prog Management System - SQL Injection - CVE-2026-14799
CodeAstro Ecommerce Website my_account.php sql injection - CVE-2026-14798
CodeAstro Apartment Visitor Management System visitor-entry.
V. Comments for CVE-2026-33734
No comments yet