Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-82029 (GCVE-0-2026-82029)

Vulnerability from cvelistv5 – Published: 2026-11-04 18:18 – Updated: 2026-11-08 14:09 X_Open Source

Title

Invoice Ninja < 5.13.28 Broken Access Control via Vendor Portal

Summary

Invoice Ninja before 5.13.28 contains a broken access control vulnerability that allows authenticated vendor-portal contacts to access documents belonging to other vendors and clients by exploiting authorization checks that validate only company_id scope instead of vendor ownership. Attackers can request GET /vendor/documents/{hashid}/download or POST /vendor/documents/download_multiple, enumerating predictable sequential Hashids document identifiers due to a default empty HASH_SALT, to read any invoice PDFs, contracts, payment receipts, and expense attachments within the company.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-05 19:09 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key
CWE-862 - Missing Authorization

Assigner

VulnCheck CNA

References

3 references

URL	Tags
https://github.com/invoiceninja/invoiceninja/rele…	release-notes
https://github.com/invoiceninja/invoiceninja/comm…	patch
https://www.vulncheck.com/advisories/invoice-ninj…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
invoiceninja	invoiceninja	Affected: 0 , < 5.13.28 (semver)

Date Public

2026-07-18 00:00

Credits

Michael Holmquist, HASP Labs

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-82029",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-05T19:09:52.914547Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T19:10:09.410Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/invoiceninja/invoiceninja",
          "product": "invoiceninja",
          "repo": "https://github.com/invoiceninja/invoiceninja",
          "vendor": "invoiceninja",
          "versions": [
            {
              "lessThan": "5.13.28",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Michael Holmquist, HASP Labs"
        }
      ],
      "datePublic": "2026-07-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Invoice Ninja before 5.13.28 contains a broken access control vulnerability that allows authenticated vendor-portal contacts to access documents belonging to other vendors and clients by exploiting authorization checks that validate only company_id scope instead of vendor ownership. Attackers can request GET /vendor/documents/{hashid}/download or POST /vendor/documents/download_multiple, enumerating predictable sequential Hashids document identifiers due to a default empty HASH_SALT, to read any invoice PDFs, contracts, payment receipts, and expense attachments within the company."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T14:09:08.007Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "invoiceninja 5.13.28 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/invoiceninja/invoiceninja/releases/tag/v5.13.28"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/invoiceninja/invoiceninja/commit/4895dce820e37b849b34af46548afd8520bb81d1"
        },
        {
          "name": "VulnCheck Advisory: Invoice Ninja \u003c 5.13.28 Broken Access Control via Vendor Portal",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/invoice-ninja-broken-access-control-via-vendor-portal"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "Invoice Ninja \u003c 5.13.28 Broken Access Control via Vendor Portal",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-82029",
    "datePublished": "2026-11-04T18:18:07.285Z",
    "dateReserved": "2026-08-27T21:39:20.460Z",
    "dateUpdated": "2026-11-08T14:09:08.007Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-83744 (GCVE-0-2026-83744)

Vulnerability from cvelistv5 – Published: 2026-09-01 05:00 – Updated: 2026-09-02 17:56

Title

invoiceninja Invoice Ninja invoices Endpoint Purify.php isHostSafe server-side request forgery

Summary

A security vulnerability has been detected in invoiceninja Invoice Ninja up to 5.13.26. This vulnerability affects the function Purify::isHostSafe of the file app/Services/Pdf/Purify.php of the component invoices Endpoint. The manipulation of the argument notes leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-02 17:55 UTC

CWE

CWE-918 - Server-Side Request Forgery

Assigner

VulDB CNA

References

5 references

URL	Tags
https://vuldb.com/vuln/397500	vdb-entrytechnical-description
https://vuldb.com/vuln/397500/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-83744	third-party-advisory
https://vuldb.com/submit/880055	third-party-advisory
https://ashutosh-jena.in/blog/server-side-request…	exploit

Impacted products

1 product

Vendor	Product	Version
invoiceninja	Invoice Ninja	Affected: 5.13.0 Affected: 5.13.1 Affected: 5.13.2 Affected: 5.13.3 Affected: 5.13.4 Affected: 5.13.5 Affected: 5.13.6 Affected: 5.13.7 Affected: 5.13.8 Affected: 5.13.9 Affected: 5.13.10 Affected: 5.13.11 Affected: 5.13.12 Affected: 5.13.13 Affected: 5.13.14 Affected: 5.13.15 Affected: 5.13.16 Affected: 5.13.17 Affected: 5.13.18 Affected: 5.13.19 Affected: 5.13.20 Affected: 5.13.21 Affected: 5.13.22 Affected: 5.13.23 Affected: 5.13.24 Affected: 5.13.25 Affected: 5.13.26 cpe:2.3:a:invoiceninja:invoice_ninja::::::::

Credits

MAVERICK-VF142 (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-83744",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-02T17:55:47.402268Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-02T17:56:01.222Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:invoiceninja:invoice_ninja:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "invoices Endpoint"
          ],
          "product": "Invoice Ninja",
          "vendor": "invoiceninja",
          "versions": [
            {
              "status": "affected",
              "version": "5.13.0"
            },
            {
              "status": "affected",
              "version": "5.13.1"
            },
            {
              "status": "affected",
              "version": "5.13.2"
            },
            {
              "status": "affected",
              "version": "5.13.3"
            },
            {
              "status": "affected",
              "version": "5.13.4"
            },
            {
              "status": "affected",
              "version": "5.13.5"
            },
            {
              "status": "affected",
              "version": "5.13.6"
            },
            {
              "status": "affected",
              "version": "5.13.7"
            },
            {
              "status": "affected",
              "version": "5.13.8"
            },
            {
              "status": "affected",
              "version": "5.13.9"
            },
            {
              "status": "affected",
              "version": "5.13.10"
            },
            {
              "status": "affected",
              "version": "5.13.11"
            },
            {
              "status": "affected",
              "version": "5.13.12"
            },
            {
              "status": "affected",
              "version": "5.13.13"
            },
            {
              "status": "affected",
              "version": "5.13.14"
            },
            {
              "status": "affected",
              "version": "5.13.15"
            },
            {
              "status": "affected",
              "version": "5.13.16"
            },
            {
              "status": "affected",
              "version": "5.13.17"
            },
            {
              "status": "affected",
              "version": "5.13.18"
            },
            {
              "status": "affected",
              "version": "5.13.19"
            },
            {
              "status": "affected",
              "version": "5.13.20"
            },
            {
              "status": "affected",
              "version": "5.13.21"
            },
            {
              "status": "affected",
              "version": "5.13.22"
            },
            {
              "status": "affected",
              "version": "5.13.23"
            },
            {
              "status": "affected",
              "version": "5.13.24"
            },
            {
              "status": "affected",
              "version": "5.13.25"
            },
            {
              "status": "affected",
              "version": "5.13.26"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "MAVERICK-VF142 (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security vulnerability has been detected in invoiceninja Invoice Ninja up to 5.13.26. This vulnerability affects the function Purify::isHostSafe of the file app/Services/Pdf/Purify.php of the component invoices Endpoint. The manipulation of the argument notes leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T05:00:12.817Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-397500 | invoiceninja Invoice Ninja invoices Endpoint Purify.php isHostSafe server-side request forgery",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/397500"
        },
        {
          "name": "VDB-397500 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/397500/cti"
        },
        {
          "name": "CVE-2026-83744 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-83744"
        },
        {
          "name": "Submit #880055 | invoiceninja Invoice Ninja 5.13.26 Server-Side Request Forgery",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/880055"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://ashutosh-jena.in/blog/server-side-request-forgery-ssrf-in-invoice-ninja-pdf-rendering-v51326"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-31T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-01T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-01T00:57:36.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "invoiceninja Invoice Ninja invoices Endpoint Purify.php isHostSafe server-side request forgery",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-83744",
    "datePublished": "2026-09-01T05:00:12.817Z",
    "dateReserved": "2026-08-31T22:52:25.114Z",
    "dateUpdated": "2026-09-02T17:56:01.222Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-83743 (GCVE-0-2026-83743)

Vulnerability from cvelistv5 – Published: 2026-09-01 04:30 – Updated: 2026-09-01 12:28 X_Open Source

Title

invoiceninja Invoice Ninja Vendor Portal Profile Update profile authorization

Summary

A weakness has been identified in invoiceninja Invoice Ninja up to 5.13.26. This affects an unknown part of the file /vedor/profile/ of the component Vendor Portal Profile Update. Executing a manipulation of the argument vendor_contact can lead to authorization bypass. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. Upgrading to version 5.13.27 is able to mitigate this issue. This patch is called f86fd9697ce7bd0d28adbe2e6c5890780482ea90. The affected component should be upgraded.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

6.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-01 12:27 UTC

CWE

CWE-639 - Authorization Bypass
CWE-285 - Improper Authorization

Assigner

VulDB CNA

References

7 references

URL	Tags
https://vuldb.com/vuln/397499	vdb-entrytechnical-description
https://vuldb.com/vuln/397499/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-83743	third-party-advisory
https://vuldb.com/submit/880053	third-party-advisory
https://ashutosh-jena.in/blog/broken-access-contr…	exploit
https://github.com/invoiceninja/invoiceninja/comm…	patch
https://github.com/invoiceninja/invoiceninja/rele…	patch

Impacted products

1 product

Vendor	Product	Version
invoiceninja	Invoice Ninja	Affected: 5.13.0 Affected: 5.13.1 Affected: 5.13.2 Affected: 5.13.3 Affected: 5.13.4 Affected: 5.13.5 Affected: 5.13.6 Affected: 5.13.7 Affected: 5.13.8 Affected: 5.13.9 Affected: 5.13.10 Affected: 5.13.11 Affected: 5.13.12 Affected: 5.13.13 Affected: 5.13.14 Affected: 5.13.15 Affected: 5.13.16 Affected: 5.13.17 Affected: 5.13.18 Affected: 5.13.19 Affected: 5.13.20 Affected: 5.13.21 Affected: 5.13.22 Affected: 5.13.23 Affected: 5.13.24 Affected: 5.13.25 Affected: 5.13.26 Unaffected: 5.13.27 cpe:2.3:a:invoiceninja:invoice_ninja::::::::

Credits

MAVERICK-VF142 (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-83743",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-01T12:27:57.593665Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-01T12:28:09.104Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:invoiceninja:invoice_ninja:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Vendor Portal Profile Update"
          ],
          "product": "Invoice Ninja",
          "vendor": "invoiceninja",
          "versions": [
            {
              "status": "affected",
              "version": "5.13.0"
            },
            {
              "status": "affected",
              "version": "5.13.1"
            },
            {
              "status": "affected",
              "version": "5.13.2"
            },
            {
              "status": "affected",
              "version": "5.13.3"
            },
            {
              "status": "affected",
              "version": "5.13.4"
            },
            {
              "status": "affected",
              "version": "5.13.5"
            },
            {
              "status": "affected",
              "version": "5.13.6"
            },
            {
              "status": "affected",
              "version": "5.13.7"
            },
            {
              "status": "affected",
              "version": "5.13.8"
            },
            {
              "status": "affected",
              "version": "5.13.9"
            },
            {
              "status": "affected",
              "version": "5.13.10"
            },
            {
              "status": "affected",
              "version": "5.13.11"
            },
            {
              "status": "affected",
              "version": "5.13.12"
            },
            {
              "status": "affected",
              "version": "5.13.13"
            },
            {
              "status": "affected",
              "version": "5.13.14"
            },
            {
              "status": "affected",
              "version": "5.13.15"
            },
            {
              "status": "affected",
              "version": "5.13.16"
            },
            {
              "status": "affected",
              "version": "5.13.17"
            },
            {
              "status": "affected",
              "version": "5.13.18"
            },
            {
              "status": "affected",
              "version": "5.13.19"
            },
            {
              "status": "affected",
              "version": "5.13.20"
            },
            {
              "status": "affected",
              "version": "5.13.21"
            },
            {
              "status": "affected",
              "version": "5.13.22"
            },
            {
              "status": "affected",
              "version": "5.13.23"
            },
            {
              "status": "affected",
              "version": "5.13.24"
            },
            {
              "status": "affected",
              "version": "5.13.25"
            },
            {
              "status": "affected",
              "version": "5.13.26"
            },
            {
              "status": "unaffected",
              "version": "5.13.27"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "MAVERICK-VF142 (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A weakness has been identified in invoiceninja Invoice Ninja up to 5.13.26. This affects an unknown part of the file /vedor/profile/ of the component Vendor Portal Profile Update. Executing a manipulation of the argument vendor_contact can lead to authorization bypass. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. Upgrading to version 5.13.27 is able to mitigate this issue. This patch is called f86fd9697ce7bd0d28adbe2e6c5890780482ea90. The affected component should be upgraded."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.5,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T04:30:16.344Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-397499 | invoiceninja Invoice Ninja Vendor Portal Profile Update profile authorization",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/397499"
        },
        {
          "name": "VDB-397499 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/397499/cti"
        },
        {
          "name": "CVE-2026-83743 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-83743"
        },
        {
          "name": "Submit #880053 | invoiceninja Invoice Ninja 5.13.26 Broken Access Control (IDOR)",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/880053"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://ashutosh-jena.in/blog/broken-access-control-idor-in-invoice-ninja-vendor-portal-v51326"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/invoiceninja/invoiceninja/commit/f86fd9697ce7bd0d28adbe2e6c5890780482ea90"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/invoiceninja/invoiceninja/releases/tag/v5.13.27"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-31T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-01T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-01T00:57:32.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "invoiceninja Invoice Ninja Vendor Portal Profile Update profile authorization",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-83743",
    "datePublished": "2026-09-01T04:30:16.344Z",
    "dateReserved": "2026-08-31T22:52:20.108Z",
    "dateUpdated": "2026-09-01T12:28:09.104Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-71233 (GCVE-0-2026-71233)

Vulnerability from cvelistv5 – Published: 2026-08-05 10:56 – Updated: 2026-08-10 11:45

Title

InvoiceNinja - Stored XSS via Invoice/Quote Terms Field

Summary

InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive {!! ->terms !!} (resources/views/portal/ninja2020/invoices/includes/terms.blade.php) with no HTML sanitization.

Severity

8.7 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-05 12:54 UTC

CWE

CWE-79 - Cross-site Scripting

Assigner

TuranSec CNA

References

1 reference

URL	Tags
https://github.com/invoiceninja/invoiceninja	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
invoiceninja	invoiceninja	Affected: 5.0.0

Date Public

2026-08-05 10:56

Credits

alibek baxtiyarov

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-71233",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-05T12:54:53.133544Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-05T12:54:59.644Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "invoiceninja",
          "programFiles": [
            "resources/views/portal/ninja2020/invoices/includes/terms.blade.php"
          ],
          "vendor": "invoiceninja",
          "versions": [
            {
              "status": "affected",
              "version": "5.0.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "alibek baxtiyarov"
        }
      ],
      "datePublic": "2026-08-05T10:56:18.781Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eInvoiceNinja v5-stable renders an invoice or quote\u0027s \"terms\" field in the client portal using Laravel Blade\u0027s raw output directive {!! -\u003eterms !!} (resources/views/portal/ninja2020/invoices/includes/terms.blade.php) with no HTML sanitization.\u003c/p\u003e"
            }
          ],
          "value": "InvoiceNinja v5-stable renders an invoice or quote\u0027s \"terms\" field in the client portal using Laravel Blade\u0027s raw output directive {!! -\u003eterms !!} (resources/views/portal/ninja2020/invoices/includes/terms.blade.php) with no HTML sanitization."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-10T11:45:31.919Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://github.com/invoiceninja/invoiceninja"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "InvoiceNinja - Stored XSS via Invoice/Quote Terms Field"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-71233",
    "datePublished": "2026-08-05T10:56:18.781Z",
    "dateReserved": "2026-08-05T10:53:53.175Z",
    "dateUpdated": "2026-08-10T11:45:31.919Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-58450 (GCVE-0-2026-58450)

Vulnerability from cvelistv5 – Published: 2026-06-30 21:07 – Updated: 2026-11-08 14:07 X_Open Source

Title

Invoice Ninja 5.13.26 - Open Redirect in Client Portal Login via intended Parameter

Summary

Invoice Ninja through 5.13.26 contains an open redirect vulnerability in the client portal login that allows unauthenticated attackers to redirect authenticated victims to attacker-controlled external URLs by injecting a malicious value into the intended query parameter. Attackers can craft a client login link with an external URL in the intended parameter, which is stored in the session without host validation and emitted verbatim via a bare redirect in the ContactLoginController authenticated() handler after the victim completes a legitimate login, enabling phishing attacks.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-01 13:48 UTC

CWE

CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Assigner

VulnCheck CNA

References

2 references

URL	Tags
https://github.com/invoiceninja/invoiceninja/issu…	technical-descriptionexploitissue-tracking
https://www.vulncheck.com/advisories/invoice-ninj…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
invoiceninja	invoiceninja	Affected: 0 , ≤ 5.13.26 (semver) cpe:2.3:a:invoiceninja:invoice_ninja::::::::

Date Public

2026-06-17 00:00

Credits

George Chen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-58450",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-01T13:48:42.421479Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-01T14:29:12.074Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/invoiceninja/invoiceninja",
          "product": "invoiceninja",
          "repo": "https://github.com/invoiceninja/invoiceninja",
          "vendor": "invoiceninja",
          "versions": [
            {
              "lessThanOrEqual": "5.13.26",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:invoiceninja:invoice_ninja:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "5.13.26",
                  "vulnerable": true
                }
              ],
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-06-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Invoice Ninja through 5.13.26 contains an open redirect vulnerability in the client portal login that allows unauthenticated attackers to redirect authenticated victims to attacker-controlled external URLs by injecting a malicious value into the intended query parameter. Attackers can craft a client login link with an external URL in the intended parameter, which is stored in the session without host validation and emitted verbatim via a bare redirect in the ContactLoginController authenticated() handler after the victim completes a legitimate login, enabling phishing attacks."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T14:07:02.962Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Researcher Disclosure",
          "tags": [
            "technical-description",
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/invoiceninja/invoiceninja/issues/12039"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/invoice-ninja-open-redirect-in-client-portal-login-via-intended-parameter"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "Invoice Ninja 5.13.26 - Open Redirect in Client Portal Login via intended Parameter",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-58450",
    "datePublished": "2026-06-30T21:07:25.092Z",
    "dateReserved": "2026-06-30T19:09:07.026Z",
    "dateUpdated": "2026-11-08T14:07:02.962Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33742 (GCVE-0-2026-33742)

Vulnerability from cvelistv5 – Published: 2026-03-26 20:50 – Updated: 2026-03-27 13:55

Title

Invoice Ninja has Stored XSS via Markdown HTML Injection in Product Notes

Summary

Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Product notes fields in Invoice Ninja v5.13.0 allow raw HTML via Markdown rendering, enabling stored XSS. The Markdown parser output was not sanitized with `purify::clean()` before being included in invoice templates. This is fixed in v5.13.4 by the vendor by adding `purify::clean()` to sanitize Markdown output.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-27 13:33 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M CNA

References

2 references

URL	Tags
https://github.com/invoiceninja/invoiceninja/secu…	x_refsource_CONFIRM
https://github.com/invoiceninja/invoiceninja/rele…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
invoiceninja	invoiceninja	Affected: < 5.13.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33742",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-27T13:33:33.494289Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-27T13:55:25.963Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/invoiceninja/invoiceninja/security/advisories/GHSA-xph7-9749-56mh"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "invoiceninja",
          "vendor": "invoiceninja",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.13.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Product notes fields in Invoice Ninja v5.13.0 allow raw HTML via Markdown rendering, enabling stored XSS. The Markdown parser output was not sanitized with `purify::clean()` before being included in invoice templates. This is fixed in v5.13.4 by the vendor by adding `purify::clean()` to sanitize Markdown output."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-26T20:50:21.984Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/invoiceninja/invoiceninja/security/advisories/GHSA-xph7-9749-56mh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/invoiceninja/invoiceninja/security/advisories/GHSA-xph7-9749-56mh"
        },
        {
          "name": "https://github.com/invoiceninja/invoiceninja/releases/tag/v5.13.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/invoiceninja/invoiceninja/releases/tag/v5.13.4"
        }
      ],
      "source": {
        "advisory": "GHSA-xph7-9749-56mh",
        "discovery": "UNKNOWN"
      },
      "title": "Invoice Ninja has Stored XSS via Markdown HTML Injection in Product Notes"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33742",
    "datePublished": "2026-03-26T20:50:21.984Z",
    "dateReserved": "2026-03-23T17:34:57.561Z",
    "dateUpdated": "2026-03-27T13:55:25.963Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33628 (GCVE-0-2026-33628)

Vulnerability from cvelistv5 – Published: 2026-03-26 20:48 – Updated: 2026-03-27 13:55

Title

Invoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line Items

Summary

Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Invoice line item descriptions in Invoice Ninja v5.13.0 bypass the XSS denylist filter, allowing stored XSS payloads to execute when invoices are rendered in the PDF preview or client portal. The line item description field was not passed through `purify::clean()` before rendering. This is fixed in v5.13.4 by the vendor by adding `purify::clean()` to sanitize line item descriptions.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-27 13:34 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-116 - Improper Encoding or Escaping of Output
CWE-184 - Incomplete List of Disallowed Inputs

Assigner

GitHub_M CNA

References

3 references

URL	Tags
https://github.com/invoiceninja/invoiceninja/secu…	x_refsource_CONFIRM
https://github.com/invoiceninja/invoiceninja/comm…	x_refsource_MISC
https://github.com/invoiceninja/invoiceninja/rele…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
invoiceninja	invoiceninja	Affected: < 5.13.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33628",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-27T13:34:13.647878Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-27T13:55:36.614Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/invoiceninja/invoiceninja/security/advisories/GHSA-98wm-cxpw-847p"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "invoiceninja",
          "vendor": "invoiceninja",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.13.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Invoice line item descriptions in Invoice Ninja v5.13.0 bypass the XSS denylist filter, allowing stored XSS payloads to execute when invoices are rendered in the PDF preview or client portal. The line item description field was not passed through `purify::clean()` before rendering. This is fixed in v5.13.4 by the vendor by adding `purify::clean()` to sanitize line item descriptions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-116",
              "description": "CWE-116: Improper Encoding or Escaping of Output",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-184",
              "description": "CWE-184: Incomplete List of Disallowed Inputs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-26T20:48:45.739Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/invoiceninja/invoiceninja/security/advisories/GHSA-98wm-cxpw-847p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/invoiceninja/invoiceninja/security/advisories/GHSA-98wm-cxpw-847p"
        },
        {
          "name": "https://github.com/invoiceninja/invoiceninja/commit/b81a3fc302573fc4a53d61e8537dd19154ce1091",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/invoiceninja/invoiceninja/commit/b81a3fc302573fc4a53d61e8537dd19154ce1091"
        },
        {
          "name": "https://github.com/invoiceninja/invoiceninja/releases/tag/v5.13.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/invoiceninja/invoiceninja/releases/tag/v5.13.4"
        }
      ],
      "source": {
        "advisory": "GHSA-98wm-cxpw-847p",
        "discovery": "UNKNOWN"
      },
      "title": "Invoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line Items"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33628",
    "datePublished": "2026-03-26T20:48:45.739Z",
    "dateReserved": "2026-03-23T14:24:11.617Z",
    "dateUpdated": "2026-03-27T13:55:36.614Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-3977 (GCVE-0-2021-3977)

Vulnerability from cvelistv5 – Published: 2021-12-24 20:10 – Updated: 2024-08-03 17:09

Title

Cross-site Scripting (XSS) - Stored in invoiceninja/invoiceninja

Summary

invoiceninja is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Severity

6.5 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

@huntrdev CNA

References

2 references

URL	Tags
https://huntr.dev/bounties/99c4ed09-b66f-474a-bd7…	x_refsource_CONFIRM
https://github.com/invoiceninja/invoiceninja/comm…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
invoiceninja	invoiceninja/invoiceninja	Affected: unspecified , < v.5.33 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:09:09.688Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/99c4ed09-b66f-474a-bd74-eeccf9339fde"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/invoiceninja/invoiceninja/commit/1186eaa82375692d01d5ef3369c5b7bc7315b55f"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "invoiceninja/invoiceninja",
          "vendor": "invoiceninja",
          "versions": [
            {
              "lessThan": "v.5.33",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "invoiceninja is vulnerable to Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-12-24T20:10:10.000Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://huntr.dev/bounties/99c4ed09-b66f-474a-bd74-eeccf9339fde"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/invoiceninja/invoiceninja/commit/1186eaa82375692d01d5ef3369c5b7bc7315b55f"
        }
      ],
      "source": {
        "advisory": "99c4ed09-b66f-474a-bd74-eeccf9339fde",
        "discovery": "EXTERNAL"
      },
      "title": "Cross-site Scripting (XSS) - Stored in invoiceninja/invoiceninja",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2021-3977",
          "STATE": "PUBLIC",
          "TITLE": "Cross-site Scripting (XSS) - Stored in invoiceninja/invoiceninja"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "invoiceninja/invoiceninja",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "v.5.33"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "invoiceninja"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "invoiceninja is vulnerable to Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://huntr.dev/bounties/99c4ed09-b66f-474a-bd74-eeccf9339fde",
              "refsource": "CONFIRM",
              "url": "https://huntr.dev/bounties/99c4ed09-b66f-474a-bd74-eeccf9339fde"
            },
            {
              "name": "https://github.com/invoiceninja/invoiceninja/commit/1186eaa82375692d01d5ef3369c5b7bc7315b55f",
              "refsource": "MISC",
              "url": "https://github.com/invoiceninja/invoiceninja/commit/1186eaa82375692d01d5ef3369c5b7bc7315b55f"
            }
          ]
        },
        "source": {
          "advisory": "99c4ed09-b66f-474a-bd74-eeccf9339fde",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2021-3977",
    "datePublished": "2021-12-24T20:10:10.000Z",
    "dateReserved": "2021-11-18T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:09:09.688Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria

8 vulnerabilities by invoiceninja

CVE-2026-82029 (GCVE-0-2026-82029)

CVE-2026-83744 (GCVE-0-2026-83744)

CVE-2026-83743 (GCVE-0-2026-83743)

CVE-2026-71233 (GCVE-0-2026-71233)

CVE-2026-58450 (GCVE-0-2026-58450)

CVE-2026-33742 (GCVE-0-2026-33742)

CVE-2026-33628 (GCVE-0-2026-33628)

CVE-2021-3977 (GCVE-0-2021-3977)