Exploit for CVE-2026-28496

CVE-2026-27604 + CVE-2026-28496 — FOSSBilling Pre-Auth RCE Cha...

FOSSBilling - Server-Side Template Injection

FOSSBilling stringrender API evaluates unsandboxed Twig, allowing SQL/info disclosure via guest.getDi.db.getCell. !/usr/bin/env python3 -- coding: utf-8 -- """FOSSBilling - Server-Side Template Injection""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient cla...

CVE-2026-28496

FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 have a Server-Side Template Injection SSTI vulnerability in the template rendering system. Administrators with access to features that render Twig templates email templates, mass mail campaigns, custo...