EUVD-2026-25811Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
9DescriptionCVE.org
A flaw has been found in code-projects Invoice System in Laravel 1.0. Affected is an unknown function of the file /item. Executing a manipulation of the argument item name/description can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used.
AnalysisAI
Cross-site scripting (XSS) in code-projects Invoice System in Laravel 1.0 allows authenticated remote attackers to inject malicious scripts via the item name/description parameter in the /item endpoint. The vulnerability requires user interaction (UI:P) and affects only the integrity of victim data (VI:L), but publicly available exploit code exists and the attack vector is network-accessible.
Technical ContextAI
The Invoice System in Laravel is a web application built on the Laravel framework. The vulnerability exists in an unidentified function handling the /item endpoint, where user-supplied input from item name and description fields is not properly sanitized or escaped before being reflected in HTTP responses. This is a classic reflected or stored cross-site scripting (XSS) vulnerability classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The Laravel framework provides built-in templating safeguards (Blade templating engine with automatic escaping), but this application either disabled automatic escaping, used raw output directives, or failed to apply proper output encoding in the vulnerable endpoint.
RemediationAI
Immediate action: Apply proper output encoding to all user-controlled input rendered in the /item endpoint. In Laravel, use double-curly braces {{ }} syntax in Blade templates (which auto-escapes HTML entities) instead of triple-curly braces {{{ }}} or unescaped directives. Validate and sanitize item name and description parameters server-side using Laravel's validation rules and the Purify or HTMLPurifier packages to strip dangerous HTML/JavaScript. Implement Content Security Policy (CSP) headers to restrict inline script execution and mitigate XSS payload effectiveness even if injection occurs. If a patched version of Invoice System in Laravel is available from code-projects.org, upgrade immediately; however, no vendor-released patch version is specified in available data. Until patched, restrict access to the /item endpoint to trusted internal users only, or disable the feature entirely if not critical to operations. Test all fixes in a staging environment before production deployment to ensure no functional regression.
More in Invoice System In Laravel
View allImproper authorization in code-projects Invoice System in Laravel 1.0 allows remote unauthenticated attackers to bypass
Code-Projects Invoice System in Laravel 1.0 allows authenticated remote attackers to bypass authorization controls via m
Improper authorization in code-projects Invoice System in Laravel 1.0 allows authenticated remote attackers to bypass ac
Improper authorization in code-projects Invoice System in Laravel 1.0 allows authenticated remote attackers to bypass ac
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today