PHPNuxBill CVE-2026-108107 and Wukong HRM CVE-2026-108707: Two Unauthenticated 9.8s

Two open source business applications, two 9.8 flaws, one thing in common: no authentication required. PHPNuxBill, a billing system for hotspots and network access, and Wukong HRM, an HR management system. The first holds customer accounts, the second holds payroll.

These are typically apps a small team installs from GitHub on an internet-facing server so users can reach them from anywhere. They don't auto-update and they often slip under the vulnerability-watch radar.

PHPNuxBill — CVE-2026-108107: SQL Injection in the FreeRADIUS Endpoint

PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint

PHPNuxBill exposes a REST endpoint for FreeRADIUS, the server that authenticates customers and accounts for their usage. That endpoint puts request parameters straight into SQL queries, without parameterisation. Since it has to answer FreeRADIUS, it's reachable without authentication.

According to NVD, an attacker can extract customer records and credentials from the database through time-based blind SQL injection. Slow, but reliable and easy to automate.

What's at stake: subscriber accounts, their network access credentials, and potentially the app's admin accounts if their hashes live in the same database.

Versions: NVD says "through 2025.3.20" and publishes no fixed version as of writing. Check the project repository for a fix or later commit, and don't treat a higher version as fixed without confirmation.

Specific steps:

1. Restrict the RADIUS endpoint to your FreeRADIUS server's addresses only, at the web server or firewall. It's the most effective measure until a fix lands: that endpoint has no reason to be reachable from the internet.
2. Apply the project's fix as soon as it's published.
3. Rotate the credentials stored in the database if the endpoint was exposed: customer accounts, RADIUS secrets, admin accounts.

Wukong HRM — CVE-2026-108707: Every HR API Without a Token

Attackers gain HR administrator access to read payslips, salary history and employee personal data

Wukong HRM's authentication check lives in an aspect (ParamAspect) meant to validate the token on each API call. It fails open: a request that carries no token isn't rejected. Every HR API becomes callable without an account.

According to NVD, the attacker gets the equivalent of an HR administrator: reading payslips, salary history and employee personal data, downloading attachments, and modifying or deleting HR records.

What's at stake: personal data under GDPR, and some of the most sensitive data a company holds. A leak like this is a reportable breach, and raw material for payment fraud or targeted social engineering.

Versions: NVD says "through commit 186115e", with no fixed version as of writing. If you deployed from the repository, check the commit running in production and watch the repository for a fix.

Specific steps:

1. Take the app off the internet: put it behind a VPN or an authenticating proxy (SSO) that requires a valid session before requests even reach the app.
2. Apply the fix as soon as it's available in the repository.
3. Assess breach notification to your data protection authority if logs show unusual access to employee data.

Detection

• PHPNuxBill: requests to the RADIUS endpoint from any address other than your FreeRADIUS server; unusually slow or numerous requests on that endpoint; SQL errors in PHP logs.
• Wukong HRM: HR API calls with no associated session in application or reverse proxy logs; abnormal read volumes on employee records or payslips; bulk attachment downloads.
• Both: new admin accounts, unrequested password changes, logins from unusual countries or hosting providers.

General Mitigation

1. Inventory the instances: these apps are often deployed outside IT's perimeter.
2. Don't expose a self-hosted business app directly to the internet without an authentication layer in front.
3. Watch the repositories of the open source projects you run: with no vendor, no advisory gets pushed to you.
4. If access looks suspicious: preserve logs, rotate every secret of the app and its database, and handle the incident as a data breach.

Why Continuous Monitoring of Open Source Business Apps Matters

An app installed from GitHub doesn't send security bulletins. Without active monitoring, a 9.8 CVE can stay open until someone uses it. And these tools often hold the most sensitive data: customers, salaries, credentials.

With cveo.tech, add your self-hosted open source apps to your inventory and get alerted whenever a critical CVE affects them.