CVE-2026-43643

Name of the Vulnerable Software and Affected Versions Softaculous Virtualizor versions prior to 3.2.9 (Patch 9) Softaculous Virtualizor version 3.0.0

Description An authorization bypass exists in the billing module handler. Unauthenticated remote attackers can modify any tenant's account balance by sending a POST request to the admin panel dispatcher with crafted act and from billing module parameters. By including arbitrary uid and balance values within the billing data field, an attacker can trigger an unauthenticated parameterized UPDATE against the users table, leading to account balance manipulation and potential automated service suspension for targeted accounts.

Recommendations Update Softaculous Virtualizor to version 3.2.9 (Patch 9) or later. Update Softaculous Virtualizor to a version newer than 3.0.0.