Invoiceninja
Monthly
Server-side request forgery in Invoice Ninja up to version 5.13.26 allows authenticated remote attackers to coerce the application server into issuing arbitrary outbound HTTP requests by injecting malicious URLs into invoice note fields. The flaw lies in the `Purify::isHostSafe()` method within `app/Services/Pdf/Purify.php`, which inadequately validates the `notes` parameter before the PDF rendering pipeline processes it. A public proof-of-concept has been disclosed by the researcher; no vendor patch or acknowledgment has been issued, leaving all installations at or below 5.13.26 without an official remediation path.
Invoice Ninja's Vendor Portal Profile Update endpoint (versions up to 5.13.26) contains an IDOR flaw in VendorContactController that allows an authenticated vendor portal user to overwrite any other vendor contact's profile by substituting a different vendor_contact ID in the update request URL. The root cause is a missing authorization check - the controller accepted raw Laravel requests with no ownership validation. A public exploit write-up and POC exist, confirmed by the VulDB report and a researcher blog post, elevating urgency despite the absence of CISA KEV listing. No special conditions beyond a valid vendor portal account are required.
Open redirect in Invoice Ninja's client portal login (through version 5.13.26) enables unauthenticated attackers to craft login URLs that transparently redirect authenticated victims to attacker-controlled external sites after they complete a legitimate login. The vulnerability stems from the `intended` query parameter being stored in the session without host validation, then emitted verbatim by the `ContactLoginController::authenticated()` handler post-login, making it a reliable phishing vector against Invoice Ninja clients. A publicly available proof-of-concept exists; no CISA KEV listing is present at time of analysis.
Stored cross-site scripting (XSS) in Invoice Ninja v5.13.0 through v5.13.3 allows authenticated attackers with product notes field access to inject and execute arbitrary JavaScript in invoice templates via unvalidated Markdown rendering. The vulnerability affects all Invoice Ninja instances running affected versions where the Markdown parser output bypasses HTML sanitization, enabling session hijacking, credential theft, or malicious template manipulation for other users viewing invoices. A vendor-released patch (v5.13.4) addresses this by implementing purify::clean() sanitization on Markdown output.
invoiceninja is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
In Invoice Ninja before 4.4.0, there is an unsafe call to unserialize() in app/Ninja/Repositories/AccountRepository.php that may allow an attacker to deserialize arbitrary PHP classes. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
Server-side request forgery in Invoice Ninja up to version 5.13.26 allows authenticated remote attackers to coerce the application server into issuing arbitrary outbound HTTP requests by injecting malicious URLs into invoice note fields. The flaw lies in the `Purify::isHostSafe()` method within `app/Services/Pdf/Purify.php`, which inadequately validates the `notes` parameter before the PDF rendering pipeline processes it. A public proof-of-concept has been disclosed by the researcher; no vendor patch or acknowledgment has been issued, leaving all installations at or below 5.13.26 without an official remediation path.
Invoice Ninja's Vendor Portal Profile Update endpoint (versions up to 5.13.26) contains an IDOR flaw in VendorContactController that allows an authenticated vendor portal user to overwrite any other vendor contact's profile by substituting a different vendor_contact ID in the update request URL. The root cause is a missing authorization check - the controller accepted raw Laravel requests with no ownership validation. A public exploit write-up and POC exist, confirmed by the VulDB report and a researcher blog post, elevating urgency despite the absence of CISA KEV listing. No special conditions beyond a valid vendor portal account are required.
Open redirect in Invoice Ninja's client portal login (through version 5.13.26) enables unauthenticated attackers to craft login URLs that transparently redirect authenticated victims to attacker-controlled external sites after they complete a legitimate login. The vulnerability stems from the `intended` query parameter being stored in the session without host validation, then emitted verbatim by the `ContactLoginController::authenticated()` handler post-login, making it a reliable phishing vector against Invoice Ninja clients. A publicly available proof-of-concept exists; no CISA KEV listing is present at time of analysis.
Stored cross-site scripting (XSS) in Invoice Ninja v5.13.0 through v5.13.3 allows authenticated attackers with product notes field access to inject and execute arbitrary JavaScript in invoice templates via unvalidated Markdown rendering. The vulnerability affects all Invoice Ninja instances running affected versions where the Markdown parser output bypasses HTML sanitization, enabling session hijacking, credential theft, or malicious template manipulation for other users viewing invoices. A vendor-released patch (v5.13.4) addresses this by implementing purify::clean() sanitization on Markdown output.
invoiceninja is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
In Invoice Ninja before 4.4.0, there is an unsafe call to unserialize() in app/Ninja/Repositories/AccountRepository.php that may allow an attacker to deserialize arbitrary PHP classes. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.