Hackfaiz

**Name of the Vulnerable Software and Affected Versions** FOSSBilling versions 0.6.0 through 0.7.2 **Description** A stored cross-site scripting (XSS) issue exists in the client-facing email history views. This occurs because email HTML content, specifically the `content html` variable, is rendered into a JavaScript template literal using the `|raw` filter, which bypasses output escaping. An attacker with administrative privileges can inject malicious JavaScript payloads into email content that will execute in the browser of any client viewing their email history. **Recommendations** Update to version 0.8.0. Restrict admin account access. Audit email content in the database for suspicious payloads. Monitor client accounts for unusual activity.