CVE-2026-33734

Name of the Vulnerable Software and Affected Versions FOSSBilling versions 0.6.0 through 0.7.2

Description A SQL injection issue exists in the Massmailer module filter functionality. An authenticated administrator can provide crafted filter values during the update of a mass email message, which allows untrusted input to be interpolated directly into the SQL recipient selection query.

Recommendations Update to version 0.8.0. Restrict administrator access to trusted users only. Disable the Massmailer module if it is not required. Audit existing records in the mod massmailer table for suspicious filter values. Review administrator activity related to Massmailer message updates.