CVE-2026-108107: Unauthenticated SQL Injection in PHPNuxBill
A critical vulnerability (CVE-2026-108107, CVSS 9.8) exists in PHPNuxBill versions up to 2025.3.20, allowing unauthenticated attackers to inject SQL via the radius.php FreeRADIUS REST endpoint. This could lead to extraction of customer records and credentials. Immediate action is required to update vulnerable installations.