Hotspotbilling vulnerabilities
We track 3 vulnerabilities in Hotspotbilling products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 9, 2026.
Latest Hotspotbilling vulnerabilities
- 9.1 Critical severity
phpnuxbill: Improper Restriction of Excessive Authentication Attempts
PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code. Attackers knowing a customer username can gu
- 7.1 High severity
phpnuxbill: Improper Authentication
PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in RADIUS CHAP verification because Password::chap_verify() returns true when the supplied response does not match. Attackers who know a valid customer or PPPoE username can log in th
- 9.8 Critical severity
phpnuxbill: Improper Neutralization of Special Elements used in an SQL Command
PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to th