CVE-2026-33628mediumCWE-116CWE-184CWE-79

CVE-2026-33628: fallo de gravedad media en invoiceninja

Invoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line Items

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear invoiceninja+ Monitorear invoiceninja/invoiceninja

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.4epss 0.2%
Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Invoice line item descriptions in Invoice Ninja v5.13.0 bypass the XSS denylist filter, allowing stored XSS payloads to execute when invoices are rendered in the PDF preview or client portal. The line item description field was not passed through `purify::clean()` before rendering. This is fixed in v5.13.4 by the vendor by adding `purify::clean()` to sanitize line item descriptions.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Productos afectados
invoiceninja · invoiceninja
CVEs relacionadas — invoiceninja

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-71233HIGHInvoiceNinja - Stored XSS via Invoice/Quote Terms FieldEPSS 0.4%CVE-2026-58450MEDIUMInvoice Ninja 5.13.26 - Open Redirect in Client Portal Login via intended ParameterEPSS 0.3%CVE-2026-82029HIGHInvoice Ninja < 5.13.28 Broken Access Control via Vendor PortalEPSS 0.2%CVE-2026-33742MEDIUMInvoice Ninja has Stored XSS via Markdown HTML Injection in Product NotesEPSS 0.2%