CVE-2026-33734

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-33734
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33734.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-33734
Aliases
  • GHSA-jf7m-j359-2899
Published
2026-07-06T20:56:26.539Z
Modified
2026-07-15T01:49:04.871401376Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
FOSSBilling has improper SQL neutralization in `Massmailer` recipient filters
Details

FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have a SQL injection vulnerability in the Massmailer module filter functionality. An authenticated administrator can supply crafted filter values when updating a mass email message, causing untrusted input to be interpolated directly into SQL in the recipient selection query. Version 0.8.0 patches the issue. Some workarounds are available. Restrict administrator access to trusted users only, disable the Massmailer module if it is not required, audit existing records in the mod_massmailer table for suspicious filter values, and/or review administrator activity related to Massmailer message updates.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33734.json"
}
References

Affected packages

Git / github.com/fossbilling/fossbilling

Affected ranges

Type
GIT
Repo
https://github.com/fossbilling/fossbilling
Events
Introduced
424b84e2c085d4cf702be9969ebd42d6a9e40757
Fixed
3bd35f5b2921d8a26a403142ae0408f95e6463cc
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ],
    "extracted_events": [
        {
            "introduced": "0.6.0"
        },
        {
            "fixed": "0.8.0"
        },
        {
            "fixed": "0.7.2"
        }
    ]
}

Affected versions

0.*
0.6.0
0.6.1
0.6.10
0.6.11
0.6.12
0.6.13
0.6.14
0.6.15
0.6.16
0.6.17
0.6.18
0.6.19
0.6.2
0.6.20
0.6.21
0.6.22
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.6.8
0.6.9
0.7.0
0.7.1
0.7.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33734.json"