EUVD-2026-96871

A vulnerability was determined in InstantSoft icms2 up to 2.18.2. The affected element is the function validatePaypalOrder of the file system/controllers/billing/actions/paypal.php of the component Billing Module. Executing a manipulation of the argument bid/sig can lead to insufficient...

CVE-2026-108568

The InstantSoft icms2 software (versions up to 2.18.2 ) contains a vulnerability in the Billing Module specifically within the validatePaypalOrder function located in the file system/controllers/billing/actions/paypal.php. An attacker can remotely manipulate the bid/sig arguments to cause insuffi...

CVE-2026-107852

Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe Checkout Session when paymentstatus is paid but does not compare amounttotal or currency with the referenced order and...

CVE-2026-107852 Jexactyl: Stripe checkout confirmation accepts mismatched-currency/amount payments as full payment (payment forgery)

Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe Checkout Session when paymentstatus is paid but does not compare amounttotal or currency with the referenced order and...

CVE-2026-107852

In Jexactyl (a game management and billing system), a vulnerability exists prior to version 4.0.5 in the POST /api/client/billing/stripe/process endpoint. The system fails to verify if the amount_total or currency of a client-supplied Stripe Checkout Session matches the referenced order's require...

CVE-2026-43641

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains an OS command injection vulnerability in the billing module handler that allows unauthenticated remote attackers to execute arbitrary commands as root by bypassing authentication through specific parameter combinations. Attackers can...

CVE-2026-43642

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains a PHP object injection vulnerability in the billing module handler that allows unauthenticated remote attackers to supply arbitrary serialized PHP objects for deserialization by setting the act parameter to login with the...

CVE-2026-43643

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticated remote attackers to modify any tenant's account balance by supplying crafted act and frombillingmodule parameters to the admin panel...

CVE-2026-43643 Softaculous Virtualizor Authorization Bypass via Billing Module Handler

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticated remote attackers to modify any tenant's account balance by supplying crafted act and frombillingmodule parameters to the admin panel...

CVE-2026-43643 Softaculous Virtualizor Authorization Bypass via Billing Module Handler

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticated remote attackers to modify any tenant's account balance by supplying crafted act and frombillingmodule parameters to the admin panel...

CVE-2026-43643

Softaculous Virtualizor versions before 3.2.9 (Patch 9) and 3.0.0 are susceptible to an authorization bypass vulnerability in the billing module handler. An unauthenticated remote attacker can modify any tenant's account balance by sending a POST request to the admin panel dispatcher with crafted...

EUVD-2026-84624

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticated remote attackers to modify any tenant's account balance by supplying crafted act and frombillingmodule parameters to the admin panel...

CVE-2026-43642 Softaculous Virtualizor PHP Object Injection via Billing Module Handler

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains a PHP object injection vulnerability in the billing module handler that allows unauthenticated remote attackers to supply arbitrary serialized PHP objects for deserialization by setting the act parameter to login with the...

CVE-2026-43642 Softaculous Virtualizor PHP Object Injection via Billing Module Handler

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains a PHP object injection vulnerability in the billing module handler that allows unauthenticated remote attackers to supply arbitrary serialized PHP objects for deserialization by setting the act parameter to login with the...

CVE-2026-43642

Softaculous Virtualizor versions before 3.2.9 (Patch 9) and 3.0.0 are vulnerable to a PHP object injection flaw in the billing module handler. An unauthenticated remote attacker can achieve remote code execution as root by supplying arbitrary serialized PHP objects via the billing_data POST field...

EUVD-2026-84622

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains a PHP object injection vulnerability in the billing module handler that allows unauthenticated remote attackers to supply arbitrary serialized PHP objects for deserialization by setting the act parameter to login with the...

CVE-2026-43641 Softaculous Virtualizor OS Command Injection via Billing Module Handler

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains an OS command injection vulnerability in the billing module handler that allows unauthenticated remote attackers to execute arbitrary commands as root by bypassing authentication through specific parameter combinations. Attackers can...

CVE-2026-43641

Softaculous Virtualizor versions before 3.2.9 (Patch 9) and 3.0.0 are vulnerable to an OS command injection in the billing module handler. Unauthenticated remote attackers can bypass authentication using specific parameter combinations to deserialize a crafted billing_data POST field. The uid fie...

EUVD-2026-84620

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains an OS command injection vulnerability in the billing module handler that allows unauthenticated remote attackers to execute arbitrary commands as root by bypassing authentication through specific parameter combinations. Attackers can...

CVE-2026-43641 Softaculous Virtualizor OS Command Injection via Billing Module Handler

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains an OS command injection vulnerability in the billing module handler that allows unauthenticated remote attackers to execute arbitrary commands as root by bypassing authentication through specific parameter combinations. Attackers can...