Invoiceninja

Invoice Ninja

15 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
7.7

CVE-2025-0474

  • EPSS 0.4%
  • Veröffentlicht 14.01.2025 19:15:32
  • Zuletzt bearbeitet 14.07.2026 23:17:18

Invoice Ninja is vulnerable to authenticated Server-Side Request Forgery (SSRF) allowing for arbitrary file read and network resource requests as the application user. This issue affects Invoice Ninja: from 5.8.56 through 5.11.23.

8.8

CVE-2024-55555

  • EPSS 6.61%
  • Veröffentlicht 07.01.2025 17:15:30
  • Zuletzt bearbeitet 15.04.2026 00:35:42

Invoice Ninja before 5.10.43 allows remote code execution from a pre-authenticated route when an attacker knows the APP_KEY. This is exacerbated by .env files, available from the product's repository, that have default APP_KEY values. The route/{hash...

5.4

CVE-2021-3977

Exploit
  • EPSS 0.59%
  • Veröffentlicht 24.12.2021 20:15:08
  • Zuletzt bearbeitet 21.11.2024 06:23:17

invoiceninja is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

8.1

CVE-2021-33898

  • EPSS 1.8%
  • Veröffentlicht 06.06.2021 23:15:07
  • Zuletzt bearbeitet 21.11.2024 06:09:44

In Invoice Ninja before 4.4.0, there is an unsafe call to unserialize() in app/Ninja/Repositories/AccountRepository.php that may allow an attacker to deserialize arbitrary PHP classes. In certain contexts, this can result in remote code execution. Th...

5.4

CVE-2017-1000466

Exploit
  • EPSS 0.79%
  • Veröffentlicht 03.01.2018 01:29:00
  • Zuletzt bearbeitet 21.11.2024 03:04:47

Invoice Ninja version 3.8.1 is vulnerable to stored cross-site scripting vulnerability, within the invoice creation page, which can result in disruption of service and execution of javascript code.