Veille CVE

Vendredi 9 octobre 2026

1 CVE sur 9

Critique 1 Élevée 4 Moyenne 3 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « git » ✕
  1. CVE-2026-108109 9.1 Critique

    hotspotbilling phpnuxbill

    PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code. Attackers knowing a customer username can guess the code without attempt limits or lockout, then read the newly set password from the HTTP response to hijack the account.