CVE-2026-111048

FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.9, the admin/support/note_create endpoint stores the note parameter without sanitization in the support_ticket_note table, and src/modules/Support/templates/admin/mod_support_tickets.html.twig renders each stored support ticket note through innerHTML in the admin ticket list. A staff user with only the support.manage_tickets permission can store HTML or JavaScript that executes when another staff member opens the ticket notes. The script runs with the viewing staff member's session and privileges, can read a CSRF token and accessible client or invoice data, and can perform administrative actions available to the viewer, including a Super Administrator. The ticket detail page is not affected because its Twig rendering uses autoescaping. This issue is fixed in version 0.8.9.

• CWE-79

• https://github.com/FOSSBilling/FOSSBilling/commit/87528920b6cb1ba6f113583253eb4d7abdd1d8c6
• https://github.com/FOSSBilling/FOSSBilling/pull/4548
• https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.9
• https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-493h-fvcx-6q62

Published

Nov 2, 2026

Last Modified

Nov 3, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11104Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7…6.5
• CVE-2026-111040The platform allows persistent HTML injection into editable …5.1
• CVE-2026-111041The AI Engine WordPress plugin before 3.7.9 does not verify…4.9
• CVE-2026-111044Sunshine is a self-hosted game stream host for Moonlight. Fr…7.6
• CVE-2026-111045CLI Bridge provides filesystem access within a workspace roo…7.5
• CVE-2026-111046FOSSBilling is an open source billing and client-management …2.3
• CVE-2026-11105Insufficient validation of untrusted input in WebUI in Googl…6.5
• CVE-2026-111053FOSSBilling is an open source billing and client-management …6.9
• CVE-2026-111054Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-111056FOSSBilling is an open source billing and client-management …6.9
• CVE-2026-111057Mercury is a Python framework for sharing Jupyter notebooks …10
• CVE-2026-111058Mercury is a Python framework for sharing Jupyter notebooks …9.8