CVE-2026-33628mediumCWE-116CWE-184CWE-79

CVE-2026-33628: falha de média gravidade em invoiceninja

Invoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line Items

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar invoiceninja+ Monitorar invoiceninja/invoiceninja

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.4epss 0.2%
Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Invoice line item descriptions in Invoice Ninja v5.13.0 bypass the XSS denylist filter, allowing stored XSS payloads to execute when invoices are rendered in the PDF preview or client portal. The line item description field was not passed through `purify::clean()` before rendering. This is fixed in v5.13.4 by the vendor by adding `purify::clean()` to sanitize line item descriptions.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
invoiceninja · invoiceninja
CVEs relacionadas — invoiceninja

No mesmo produto, das mais perigosas para as menos.

CVE-2026-71233HIGHInvoiceNinja - Stored XSS via Invoice/Quote Terms FieldEPSS 0.4%CVE-2026-58450MEDIUMInvoice Ninja 5.13.26 - Open Redirect in Client Portal Login via intended ParameterEPSS 0.3%CVE-2026-82029HIGHInvoice Ninja < 5.13.28 Broken Access Control via Vendor PortalEPSS 0.2%CVE-2026-33742MEDIUMInvoice Ninja has Stored XSS via Markdown HTML Injection in Product NotesEPSS 0.2%