NVD CRITICAL: CVE-2026-108107 — PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerabi...

Friday, October 9, 2026 at 03:17 PM UTC·Source: NIST NVD

Updated: Friday, October 9, 2026 at 04:00 PM UTC

Executive Summary

PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to extract customer records and credentials via time-based blind SQL injection.

Analysis

Indicators of Compromise (1)

CVE (1)

CVE-2026-108107

NVD MITRE CVE

Source Attribution

Originally published by NIST NVD on Oct 9, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

Indian tech company eMudhra announces withdrawal from certificate business after security incident

The issue was publicized by cybersecurity researcher Scott Helme, who published a blog saying that instead of a random 384-bit number, one of the company's private keys was just the number four.

1h agoThe Record

MEDIUMVulnerability

eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable

eMudhra, an Indian certificate authority (CA), will withdraw from its global SSL/TLS certificate business, its board decided on Thursday. The decision came five days after a researcher reported recovering the private keys of eight of its intermediate CA certificates. eMudhra said it will replace affected customers' certificates with free ones from partners, though its

1h agoThe Hacker News

CRITICALVulnerability

I had plans for that second

The Earth is speeding up, the leap second is being abolished, oh, and there's critical vulnerabilities in PHP.

1h agoCisco Talos