EUVD-2026-17150
GHSA-r7m8-874r-4g5v
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
Invoice Ninja v5.12.46 and v5.12.48 is vulnerable to Server-Side Request Forgery (SSRF) in CheckDatabaseRequest.php.
AnalysisAI
Invoice Ninja versions 5.12.46 and 5.12.48 contain a Server-Side Request Forgery (SSRF) vulnerability in the CheckDatabaseRequest.php component that allows remote attackers to perform unauthorized requests to internal or external systems. The vulnerability affects the setup and database configuration functionality, potentially enabling attackers to access internal services, probe private networks, or interact with restricted resources from the server's perspective.
Technical ContextAI
The vulnerability exists in Invoice Ninja's setup request handler (CheckDatabaseRequest.php), a PHP-based component responsible for validating database connection parameters during initial application configuration. SSRF vulnerabilities in this context typically occur when user-supplied input (such as database host, endpoint, or connection parameters) is not properly validated before being used in server-side HTTP requests or network operations. The vulnerability allows an attacker to craft malicious input that causes the server to make unintended requests to arbitrary hosts, including internal IP addresses, localhost services, or cloud metadata endpoints. PHP's curl or file operations are commonly the underlying mechanism enabling such attacks.
RemediationAI
Upgrade Invoice Ninja to a patched version released after 5.12.48; consult the official Invoice Ninja GitHub repository and security advisories at https://github.com/invoiceninja/invoiceninja for the specific fix version and release notes. As an interim mitigation, if upgrades cannot be immediately deployed, restrict network access to the setup and configuration endpoints (CheckDatabaseRequest.php and related setup routes) using firewall rules or web application firewall policies to allow only trusted internal administrative IPs. Disable or remove setup functionality in production environments after initial deployment to minimize exposure surface. Review server-side request handling in CheckDatabaseRequest.php and ensure all user-supplied database connection parameters are validated against a whitelist of approved hosts and are not directly interpolated into network requests.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today