CVE-2026-108107

Name of the Vulnerable Software and Affected Versions PHPNuxBill versions prior to 2025.3.21

Description An unauthenticated SQL injection exists in the radius.php FreeRADIUS REST endpoint. The issue occurs because request parameters are interpolated into whereRaw() queries. An attacker can send crafted username, macAddr, or nasid parameters to the accounting or authenticate actions to extract customer records and credentials using time-based blind SQL injection, a technique that infers data by observing the time the server takes to respond to specific queries.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.