Invoice Ninja unserialize RCE

The vulnerability of the unserialize function in the Invoice Ninja software’s app/Ninja/Repositories/AccountRepository.php file involves the restoration of unreliable data in memory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

CVE-2021-33898

In Invoice Ninja before 4.4.0, there is an unsafe call to unserialize in app/Ninja/Repositories/AccountRepository.php that may allow an attacker to deserialize arbitrary PHP classes. In certain contexts, this can result in remote code execution. The attacker's input must be hosted at...

CVE-2021-33898: Deserialization of Untrusted Data

In Invoice Ninja before 4.4.0, there is an unsafe call to unserialize in app/Ninja/Repositories/AccountRepository.php that may allow an attacker to deserialize arbitrary PHP classes. In certain contexts, this can result in remote code execution. The attacker's input must be hosted at...

PT-2021-3467

Name of the Vulnerable Software and Affected Versions Invoice Ninja versions prior to 4.4.0 Description The issue is related to an unsafe call to unserialize in app/Ninja/Repositories/AccountRepository.php, which may allow an attacker to deserialize arbitrary PHP classes. This can result in remot...