Invoice Ninja
Monthly
Server-side request forgery in Invoice Ninja up to version 5.13.26 allows authenticated remote attackers to coerce the application server into issuing arbitrary outbound HTTP requests by injecting malicious URLs into invoice note fields. The flaw lies in the `Purify::isHostSafe()` method within `app/Services/Pdf/Purify.php`, which inadequately validates the `notes` parameter before the PDF rendering pipeline processes it. A public proof-of-concept has been disclosed by the researcher; no vendor patch or acknowledgment has been issued, leaving all installations at or below 5.13.26 without an official remediation path.
Invoice Ninja's Vendor Portal Profile Update endpoint (versions up to 5.13.26) contains an IDOR flaw in VendorContactController that allows an authenticated vendor portal user to overwrite any other vendor contact's profile by substituting a different vendor_contact ID in the update request URL. The root cause is a missing authorization check - the controller accepted raw Laravel requests with no ownership validation. A public exploit write-up and POC exist, confirmed by the VulDB report and a researcher blog post, elevating urgency despite the absence of CISA KEV listing. No special conditions beyond a valid vendor portal account are required.
invoiceninja is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
In Invoice Ninja before 4.4.0, there is an unsafe call to unserialize() in app/Ninja/Repositories/AccountRepository.php that may allow an attacker to deserialize arbitrary PHP classes. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
Server-side request forgery in Invoice Ninja up to version 5.13.26 allows authenticated remote attackers to coerce the application server into issuing arbitrary outbound HTTP requests by injecting malicious URLs into invoice note fields. The flaw lies in the `Purify::isHostSafe()` method within `app/Services/Pdf/Purify.php`, which inadequately validates the `notes` parameter before the PDF rendering pipeline processes it. A public proof-of-concept has been disclosed by the researcher; no vendor patch or acknowledgment has been issued, leaving all installations at or below 5.13.26 without an official remediation path.
Invoice Ninja's Vendor Portal Profile Update endpoint (versions up to 5.13.26) contains an IDOR flaw in VendorContactController that allows an authenticated vendor portal user to overwrite any other vendor contact's profile by substituting a different vendor_contact ID in the update request URL. The root cause is a missing authorization check - the controller accepted raw Laravel requests with no ownership validation. A public exploit write-up and POC exist, confirmed by the VulDB report and a researcher blog post, elevating urgency despite the absence of CISA KEV listing. No special conditions beyond a valid vendor portal account are required.
invoiceninja is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
In Invoice Ninja before 4.4.0, there is an unsafe call to unserialize() in app/Ninja/Repositories/AccountRepository.php that may allow an attacker to deserialize arbitrary PHP classes. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.