EUVD-2026-84624
GHSA-g658-6cgx-fx2p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network exploit of a missing authorization check (PR:N, AC:L); impact is integrity-only rewrite of the users table (I:H), with no direct confidentiality or availability effect (C:N/A:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticated remote attackers to modify any tenant's account balance by supplying crafted act and from_billing_module parameters to the admin panel dispatcher. Attackers can send a POST request with arbitrary uid and balance values in the billing_data field to trigger an unauthenticated parameterized UPDATE against the users table, enabling account balance manipulation and potential automated service suspension for targeted accounts.
AnalysisAI
Unauthenticated attackers can rewrite any tenant's account balance in Softaculous Virtualizor before 3.2.9 (Patch 9) and in 3.0.0 by POSTing crafted 'act' and 'from_billing_module' parameters together with a 'billing_data' body containing arbitrary uid and balance values to the admin panel dispatcher, which executes a parameterized UPDATE against the users table without performing any authorization check. Publicly available exploit code exists, and vendor patches are available (3.2.9 Patch 9 and 3.3.0). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against default configurations of Softaculous Virtualizor before 3.2.9 Patch 9 (and version 3.0.0). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a real, actionable priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the vendor-released patch: Virtualizor 3.2.9 Patch 9, or the 3.3.0 release, per the advisories at https://www.virtualizor.com/blog/virtualizor-3-2-9-launched-release-candidate-patch-9/ and https://www.virtualizor.com/blog/virtualizor-3-3-0/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every internet-reachable Virtualizor admin panel, confirm the running version, and where the panel cannot be immediately upgraded restrict access to trusted management networks or a VPN via firewall rules or the vendor's IP allowlist; simultaneously capture a baseline of current tenant balances and billing records so that any tampering can be detected and reversed, and review dispatcher and billing-module logs for POST requests containing unusual 'act' or 'from_billing_module' parameters. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Softaculous
View allUnauthenticated remote command execution in Softaculous Virtualizor before 3.2.9 Patch 9 (and the 3.0.0 branch) lets att
Remote code execution in Softaculous Virtualizor before 3.2.9 Patch 9 (and the 3.0.0 line) allows unauthenticated remote
index.php in Softaculous Webuzo before 2.1.4 allows remote attackers to execute arbitrary commands via shell metacharact
A vulnerability has been found in AMPPS 2.7 and classified as problematic. Rated high severity (CVSS 7.5), this vulnerab
The login function in Softaculous Webuzo before 2.1.4 provides different error messages for invalid authentication attem
The WHMCS Reseller Module V2 2.0.2 in Softaculous Virtualizor before 2.9.1.0 does not verify the user correctly, which a
Softaculous Webuzo contains an authentication bypass vulnerability through the password reset functionality. Rated criti
Softaculous Webuzo contains a command injection vulnerability in the FTP management functionality. Rated high severity (
Softaculous Webuzo contains a command injection in the password reset functionality. Rated high severity (CVSS 8.8), thi
Cross-site scripting (XSS) vulnerability in filemanager/login.php in the File Manager module in Softaculous Webuzo befor
The Backuply - Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Denial of Service in all version
The Backuply - Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the 'options'
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today