CVE-2026-111048

The open source billing and client-management platform FOSSBilling is vulnerable to stored Cross-Site Scripting (XSS) in versions prior to 0.8.9 . The admin/support/note_create endpoint fails to sanitize the note parameter before storing it in the support_ticket_note table. Subsequently, the mod_...

CVE-2026-111048 FOSSBilling: Low-privileged staff can run JavaScript in administrators' browsers via stored XSS in support ticket notes

FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.9, the admin/support/notecreate endpoint stores the note parameter without sanitization in the supportticketnote table, and src/modules/Support/templates/admin/modsupporttickets.html.twig renders each store...