by Kastro
Paper/Archive/CVE-2026-31049

CVE-2026-31049

mitre — An issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to execute arbitrary code and escalate privileges via the CSV r…

EPSS 0.7%public exploitCVSS 9.8
critical.is priorityof 100
50
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 51.6.516 × 2010.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

An issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to execute arbitrary code and escalate privileges via the CSV registration field

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refhostbillapp.com/changelogrefhostbillapp.com/release-notes/11-27-2025.htmlrefblog.hostbillapp.com/2025/12/03/hostbill-security-advisoryrefhostbillapp.com/responsible-disclosurerefhostbillapp.com/release-notes/12-01-2025.htmlrefgithub.com/Muhammad5235/HostBill-CVEs-2025/blob/main/Missing%20Server-Side%20Validation/Registration%20fields%20%26%20Import%20Csv