Search

Find a vulnerability

Search criteria

    5 vulnerabilities by Ubilling

    GCVE-115-2026-00007

    Vulnerability from gna-115 – Published: 2026-11-12 15:57 – Updated: 2026-11-12 15:57
    VLAI
    Title
    SQL Injection in Ubilling DealWithIt API
    Summary
    Multiple SQL injection vulnerabilities were identified in the api.dealwithit.php endpoint of Ubilling v1.5.8. The tariff and tariff_contains parameters and related exclude fields are concatenated into SQL statements without sanitization. The vulnerability may allow enumeration of user logins, extraction of data, or data modification depending on database configuration. The source disclosure reported no official patch at publication. Restrict access to the API, implement prepared statements, and validate incoming parameters before database usage. Source identifier: GCVE-115-2026-20032. Imported from the CIRCL disclosure published on 2026-11-11.
    Severity
    No CVSS data available.
    CWE
    Assigner
    Adrian Dacka GNA GNA-115
    GNA scorecard D 46/100 over 10 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Ubilling Ubilling Affected: 1.5.8
    		Create a notification for this product.
    Date Public
    2026-11-11 00:00
    Credits
    Adrian "syrex1013" Dacka
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Ubilling",
          "vendor": "Ubilling",
          "versions": [
            {
              "status": "affected",
              "version": "1.5.8"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Adrian \"syrex1013\" Dacka"
        }
      ],
      "datePublic": "2026-11-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple SQL injection vulnerabilities were identified in the api.dealwithit.php endpoint of Ubilling v1.5.8. The tariff and tariff_contains parameters and related exclude fields are concatenated into SQL statements without sanitization. The vulnerability may allow enumeration of user logins, extraction of data, or data modification depending on database configuration.\n\nThe source disclosure reported no official patch at publication. Restrict access to the API, implement prepared statements, and validate incoming parameters before database usage.\n\nSource identifier: GCVE-115-2026-20032. Imported from the CIRCL disclosure published on 2026-11-11."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "references": [
        {
          "url": "https://vulnerability.circl.lu/disclosure/81558045-1cf2-4406-bac6-7c02f7d15791"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "SQL Injection in Ubilling DealWithIt API",
      "x_gcve": [
        {
          "recordType": "advisory",
          "vulnId": "GCVE-115-2026-00007"
        }
      ]
    }
  },
  "cveMetadata": {
    "datePublished": "2026-11-12T15:57:05.431Z",
    "dateReserved": "2026-11-12T15:57:05.431Z",
    "dateUpdated": "2026-11-12T15:57:05.431Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-115-2026-00007"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2020-29311 (GCVE-0-2020-29311)

    Vulnerability from nvd – Published: 2020-12-10 21:38 – Updated: 2024-08-04 16:48
    VLAI
    Summary
    Ubilling v1.0.9 allows Remote Command Execution as Root user by executing a malicious command that is injected inside the config file and being triggered by another part of the software.
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    mitre CNA under the mitre root
    CNA scorecard E 29/100 over 2146 records in the last 180 days details
    References
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T16:48:01.634Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://gist.github.com/mhaskar/bfa9c2c799fca6697bcc6a213d08cb3e"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://drive.google.com/file/d/1smOjvenPB-nE0PyIxnfujCT4KcxxkeWV/view?usp=sharing"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://drive.google.com/file/d/1iLMFSbY8x1CXIf0uFntovY6yZ7N24dQA/view?usp=sharing"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Ubilling v1.0.9 allows Remote Command Execution as Root user by executing a malicious command that is injected inside the config file and being triggered by another part of the software."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-12-10T21:38:37.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gist.github.com/mhaskar/bfa9c2c799fca6697bcc6a213d08cb3e"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://drive.google.com/file/d/1smOjvenPB-nE0PyIxnfujCT4KcxxkeWV/view?usp=sharing"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://drive.google.com/file/d/1iLMFSbY8x1CXIf0uFntovY6yZ7N24dQA/view?usp=sharing"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-29311",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Ubilling v1.0.9 allows Remote Command Execution as Root user by executing a malicious command that is injected inside the config file and being triggered by another part of the software."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://gist.github.com/mhaskar/bfa9c2c799fca6697bcc6a213d08cb3e",
              "refsource": "MISC",
              "url": "https://gist.github.com/mhaskar/bfa9c2c799fca6697bcc6a213d08cb3e"
            },
            {
              "name": "https://drive.google.com/file/d/1smOjvenPB-nE0PyIxnfujCT4KcxxkeWV/view?usp=sharing",
              "refsource": "MISC",
              "url": "https://drive.google.com/file/d/1smOjvenPB-nE0PyIxnfujCT4KcxxkeWV/view?usp=sharing"
            },
            {
              "name": "https://drive.google.com/file/d/1iLMFSbY8x1CXIf0uFntovY6yZ7N24dQA/view?usp=sharing",
              "refsource": "MISC",
              "url": "https://drive.google.com/file/d/1iLMFSbY8x1CXIf0uFntovY6yZ7N24dQA/view?usp=sharing"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-29311",
    "datePublished": "2020-12-10T21:38:37.000Z",
    "dateReserved": "2020-11-27T00:00:00.000Z",
    "dateUpdated": "2024-08-04T16:48:01.634Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2018-1000827 (GCVE-0-2018-1000827)

    Vulnerability from nvd – Published: 2018-12-20 15:00 – Updated: 2024-09-17 00:35
    VLAI
    Summary
    Ubilling version <= 0.9.2 contains a Other/Unknown vulnerability in user-controlled parameter that can result in Disclosure of confidential data, denial of service, SSRF, remote code execution.
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    mitre CNA under the mitre root
    CNA scorecard E 29/100 over 2146 records in the last 180 days details
    References
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T12:47:57.216Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://0dd.zone/2018/10/28/ubilling-Object-Injection/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/nightflyza/Ubilling/issues/330"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "dateAssigned": "2018-11-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Ubilling version \u003c= 0.9.2 contains a Other/Unknown vulnerability in user-controlled parameter that can result in Disclosure of confidential data, denial of service, SSRF, remote code execution."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-12-20T15:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://0dd.zone/2018/10/28/ubilling-Object-Injection/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nightflyza/Ubilling/issues/330"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "DATE_ASSIGNED": "2018-11-27T13:54:33.464248",
          "DATE_REQUESTED": "2018-10-28T03:56:49",
          "ID": "CVE-2018-1000827",
          "REQUESTER": "sajeeb@0dd.zone",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Ubilling version \u003c= 0.9.2 contains a Other/Unknown vulnerability in user-controlled parameter that can result in Disclosure of confidential data, denial of service, SSRF, remote code execution."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://0dd.zone/2018/10/28/ubilling-Object-Injection/",
              "refsource": "MISC",
              "url": "https://0dd.zone/2018/10/28/ubilling-Object-Injection/"
            },
            {
              "name": "https://github.com/nightflyza/Ubilling/issues/330",
              "refsource": "MISC",
              "url": "https://github.com/nightflyza/Ubilling/issues/330"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-1000827",
    "datePublished": "2018-12-20T15:00:00.000Z",
    "dateReserved": "2018-12-20T00:00:00.000Z",
    "dateUpdated": "2024-09-17T00:35:36.538Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2020-29311 (GCVE-0-2020-29311)

    Vulnerability from cvelistv5 – Published: 2020-12-10 21:38 – Updated: 2024-08-04 16:48
    VLAI
    Summary
    Ubilling v1.0.9 allows Remote Command Execution as Root user by executing a malicious command that is injected inside the config file and being triggered by another part of the software.
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    mitre CNA under the mitre root
    CNA scorecard E 29/100 over 2146 records in the last 180 days details
    References
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T16:48:01.634Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://gist.github.com/mhaskar/bfa9c2c799fca6697bcc6a213d08cb3e"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://drive.google.com/file/d/1smOjvenPB-nE0PyIxnfujCT4KcxxkeWV/view?usp=sharing"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://drive.google.com/file/d/1iLMFSbY8x1CXIf0uFntovY6yZ7N24dQA/view?usp=sharing"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Ubilling v1.0.9 allows Remote Command Execution as Root user by executing a malicious command that is injected inside the config file and being triggered by another part of the software."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-12-10T21:38:37.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gist.github.com/mhaskar/bfa9c2c799fca6697bcc6a213d08cb3e"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://drive.google.com/file/d/1smOjvenPB-nE0PyIxnfujCT4KcxxkeWV/view?usp=sharing"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://drive.google.com/file/d/1iLMFSbY8x1CXIf0uFntovY6yZ7N24dQA/view?usp=sharing"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-29311",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Ubilling v1.0.9 allows Remote Command Execution as Root user by executing a malicious command that is injected inside the config file and being triggered by another part of the software."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://gist.github.com/mhaskar/bfa9c2c799fca6697bcc6a213d08cb3e",
              "refsource": "MISC",
              "url": "https://gist.github.com/mhaskar/bfa9c2c799fca6697bcc6a213d08cb3e"
            },
            {
              "name": "https://drive.google.com/file/d/1smOjvenPB-nE0PyIxnfujCT4KcxxkeWV/view?usp=sharing",
              "refsource": "MISC",
              "url": "https://drive.google.com/file/d/1smOjvenPB-nE0PyIxnfujCT4KcxxkeWV/view?usp=sharing"
            },
            {
              "name": "https://drive.google.com/file/d/1iLMFSbY8x1CXIf0uFntovY6yZ7N24dQA/view?usp=sharing",
              "refsource": "MISC",
              "url": "https://drive.google.com/file/d/1iLMFSbY8x1CXIf0uFntovY6yZ7N24dQA/view?usp=sharing"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-29311",
    "datePublished": "2020-12-10T21:38:37.000Z",
    "dateReserved": "2020-11-27T00:00:00.000Z",
    "dateUpdated": "2024-08-04T16:48:01.634Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2018-1000827 (GCVE-0-2018-1000827)

    Vulnerability from cvelistv5 – Published: 2018-12-20 15:00 – Updated: 2024-09-17 00:35
    VLAI
    Summary
    Ubilling version <= 0.9.2 contains a Other/Unknown vulnerability in user-controlled parameter that can result in Disclosure of confidential data, denial of service, SSRF, remote code execution.
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    mitre CNA under the mitre root
    CNA scorecard E 29/100 over 2146 records in the last 180 days details
    References
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T12:47:57.216Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://0dd.zone/2018/10/28/ubilling-Object-Injection/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/nightflyza/Ubilling/issues/330"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "dateAssigned": "2018-11-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Ubilling version \u003c= 0.9.2 contains a Other/Unknown vulnerability in user-controlled parameter that can result in Disclosure of confidential data, denial of service, SSRF, remote code execution."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-12-20T15:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://0dd.zone/2018/10/28/ubilling-Object-Injection/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nightflyza/Ubilling/issues/330"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "DATE_ASSIGNED": "2018-11-27T13:54:33.464248",
          "DATE_REQUESTED": "2018-10-28T03:56:49",
          "ID": "CVE-2018-1000827",
          "REQUESTER": "sajeeb@0dd.zone",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Ubilling version \u003c= 0.9.2 contains a Other/Unknown vulnerability in user-controlled parameter that can result in Disclosure of confidential data, denial of service, SSRF, remote code execution."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://0dd.zone/2018/10/28/ubilling-Object-Injection/",
              "refsource": "MISC",
              "url": "https://0dd.zone/2018/10/28/ubilling-Object-Injection/"
            },
            {
              "name": "https://github.com/nightflyza/Ubilling/issues/330",
              "refsource": "MISC",
              "url": "https://github.com/nightflyza/Ubilling/issues/330"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-1000827",
    "datePublished": "2018-12-20T15:00:00.000Z",
    "dateReserved": "2018-12-20T00:00:00.000Z",
    "dateUpdated": "2024-09-17T00:35:36.538Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}