Billabear
Monthly
The Installation Handler in BillaBear up to 2025.01.03 exposes the processInstall function of src/BillaBear/Controller/InstallController.php without any authentication check, so remote unauthenticated requests can reach the installation workflow. The vendor was contacted but did not respond, and no fixed version is listed. A public PoC reference exists (a gist linked from the VulDB entry) but it is not verified as working exploit code; the priority label is 'this_month' rather than act_now, and no CISA KEV entry is recorded.
The Installation Handler in BillaBear up to 2025.01.03 exposes the processInstall function of src/BillaBear/Controller/InstallController.php without any authentication check, so remote unauthenticated requests can reach the installation workflow. The vendor was contacted but did not respond, and no fixed version is listed. A public PoC reference exists (a gist linked from the VulDB entry) but it is not verified as working exploit code; the priority label is 'this_month' rather than act_now, and no CISA KEV entry is recorded.