PT-2026-108940

PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp code. Attackers knowing a customer username can guess the code without attempt limits o...