CVE-2026-71233highCWE-79

CVE-2026-71233: falha de alta gravidade em invoiceninja

InvoiceNinja - Stored XSS via Invoice/Quote Terms Field

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar invoiceninja

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.4%
InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive {!! ->terms !!} (resources/views/portal/ninja2020/invoices/includes/terms.blade.php) with no HTML sanitization.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Produtos afetados
invoiceninja · invoiceninja
CVEs relacionadas — invoiceninja

No mesmo produto, das mais perigosas para as menos.

CVE-2026-58450MEDIUMInvoice Ninja 5.13.26 - Open Redirect in Client Portal Login via intended ParameterEPSS 0.3%CVE-2026-33628MEDIUMInvoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line ItemsEPSS 0.2%CVE-2026-82029HIGHInvoice Ninja < 5.13.28 Broken Access Control via Vendor PortalEPSS 0.2%CVE-2026-33742MEDIUMInvoice Ninja has Stored XSS via Markdown HTML Injection in Product NotesEPSS 0.2%