Solidinvoice
Monthly
PHP object deserialization in SolidInvoice's DataGrid LiveComponent prior to version 3.0.1 allows authenticated low-privilege users to supply arbitrary PHP-serialized payloads through the writable `context` prop, leading to potential remote code execution on the hosting server. The root cause is direct use of PHP's `unserialize()` on client-controlled input without validation or type restriction, confirmed by GitHub Security Advisory GHSA-4gj8-frx2-gmp6. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but successful exploitation yields full server compromise (C:H/I:H/A:H).
Stored cross-site scripting in SolidInvoice prior to 2.3.17 allows an authenticated administrator to upload a malicious SVG as the company logo, with the file's contents being base64-encoded and injected unescaped into every page of the application. The embedded JavaScript executes in every authenticated user's browser session, enabling session hijacking and privileged action abuse across the tenant. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Plaintext credential exposure in SolidInvoice open-source invoicing platform prior to 2.3.17 allows any actor with read access to the application database to harvest every user's REST API token directly from the api_tokens table. Because tokens are stored unhashed, secondary exposures such as SQL injection, stolen backups, replicated databases, or insider access become full account-takeover paths against the API. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV, but the patch in 2.3.17 (commit 8645391) introduces HMAC-SHA256 token hashing keyed by SOLIDINVOICE_APP_SECRET.
Cross-user API history disclosure in SolidInvoice prior to version 3.0.1 allows any authenticated company member to read the API request history of other users' API tokens by manipulating writable Symfony UX LiveComponent props on the DataGrid component. The root cause is an IDOR (CWE-639): the server accepts user-controlled identifiers in LiveComponent prop updates without verifying that the requesting user is authorized to view the referenced token's history. No public exploit code exists and no CISA KEV listing is present; vendor-released patch is available in version 3.0.1.
SolidInvoice's REST API authenticator, in all versions prior to 3.0.1, silently accepts long-lived bearer tokens via a `?token=` URL query parameter as a fallback to the intended `X-API-TOKEN` request header, causing credentials to be permanently recorded in server access logs, reverse-proxy logs, CDN access logs, browser history, and HTTP Referer headers forwarded to third-party origins. Any actor with read access to those artifacts - sysadmins, log-aggregation pipelines, analytics vendors receiving Referer data, or post-compromise intruders pivoting through log stores - can extract a valid API token and authenticate to the invoicing platform without exploiting any application logic. Version 3.0.1 fixes the issue by removing the query-parameter fallback and enforcing header-only delivery; no public exploit has been identified at time of analysis.
Invitation links in SolidInvoice prior to version 3.0.1 never expire because UserInvitation entities carry no expiry timestamp, leaving any emailed invitation token permanently valid. An attacker who obtains a past invitation link - through email forwarding, archiving, or account compromise - can use it at any future point to join a company's SolidInvoice account or silently enroll a compromised email address as a member. No public exploit has been identified at time of analysis; vendor-released patch 3.0.1 addresses the issue.
SolidInvoice version 2.3.7 is vulnerable to a stored cross-site scripting (XSS) issue in the Clients module. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SolidInvoice version 2.3.7 is vulnerable to a Stored Cross-Site Scripting (XSS) issue in the Tax Rates functionality. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in SolidInvoice up to 2.4.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in SolidInvoice up to 2.4.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in SolidInvoice up to 2.4.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in SolidInvoice up to 2.4.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in SolidInvoice up to 2.4.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
PHP object deserialization in SolidInvoice's DataGrid LiveComponent prior to version 3.0.1 allows authenticated low-privilege users to supply arbitrary PHP-serialized payloads through the writable `context` prop, leading to potential remote code execution on the hosting server. The root cause is direct use of PHP's `unserialize()` on client-controlled input without validation or type restriction, confirmed by GitHub Security Advisory GHSA-4gj8-frx2-gmp6. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but successful exploitation yields full server compromise (C:H/I:H/A:H).
Stored cross-site scripting in SolidInvoice prior to 2.3.17 allows an authenticated administrator to upload a malicious SVG as the company logo, with the file's contents being base64-encoded and injected unescaped into every page of the application. The embedded JavaScript executes in every authenticated user's browser session, enabling session hijacking and privileged action abuse across the tenant. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Plaintext credential exposure in SolidInvoice open-source invoicing platform prior to 2.3.17 allows any actor with read access to the application database to harvest every user's REST API token directly from the api_tokens table. Because tokens are stored unhashed, secondary exposures such as SQL injection, stolen backups, replicated databases, or insider access become full account-takeover paths against the API. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV, but the patch in 2.3.17 (commit 8645391) introduces HMAC-SHA256 token hashing keyed by SOLIDINVOICE_APP_SECRET.
Cross-user API history disclosure in SolidInvoice prior to version 3.0.1 allows any authenticated company member to read the API request history of other users' API tokens by manipulating writable Symfony UX LiveComponent props on the DataGrid component. The root cause is an IDOR (CWE-639): the server accepts user-controlled identifiers in LiveComponent prop updates without verifying that the requesting user is authorized to view the referenced token's history. No public exploit code exists and no CISA KEV listing is present; vendor-released patch is available in version 3.0.1.
SolidInvoice's REST API authenticator, in all versions prior to 3.0.1, silently accepts long-lived bearer tokens via a `?token=` URL query parameter as a fallback to the intended `X-API-TOKEN` request header, causing credentials to be permanently recorded in server access logs, reverse-proxy logs, CDN access logs, browser history, and HTTP Referer headers forwarded to third-party origins. Any actor with read access to those artifacts - sysadmins, log-aggregation pipelines, analytics vendors receiving Referer data, or post-compromise intruders pivoting through log stores - can extract a valid API token and authenticate to the invoicing platform without exploiting any application logic. Version 3.0.1 fixes the issue by removing the query-parameter fallback and enforcing header-only delivery; no public exploit has been identified at time of analysis.
Invitation links in SolidInvoice prior to version 3.0.1 never expire because UserInvitation entities carry no expiry timestamp, leaving any emailed invitation token permanently valid. An attacker who obtains a past invitation link - through email forwarding, archiving, or account compromise - can use it at any future point to join a company's SolidInvoice account or silently enroll a compromised email address as a member. No public exploit has been identified at time of analysis; vendor-released patch 3.0.1 addresses the issue.
SolidInvoice version 2.3.7 is vulnerable to a stored cross-site scripting (XSS) issue in the Clients module. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SolidInvoice version 2.3.7 is vulnerable to a Stored Cross-Site Scripting (XSS) issue in the Tax Rates functionality. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in SolidInvoice up to 2.4.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in SolidInvoice up to 2.4.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in SolidInvoice up to 2.4.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in SolidInvoice up to 2.4.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in SolidInvoice up to 2.4.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.