98 matches found
CVE-2026-0649 invoiceninja Migration Import Import.php copy server-side request forgery
A security vulnerability has been detected in invoiceninja up to 5.12.38. The affected element is the function copy of the file /app/Jobs/Util/Import.php of the component Migration Import. The manipulation of the argument companylogo leads to server-side request forgery. It is possible to initiat...
CVE-2026-0649
Invoice Ninja up to 5.12.38 is affected by a server-side request forgery in the Migration Import component. The vulnerability is in the copy function of /app/Jobs/Util/Import.php where manipulation of the company_logo argument can be exploited remotely. Public disclosures exist; exploitation deta...
Invoice Ninja 代码问题漏洞
Invoice Ninja is a free invoicing software from Invoice Ninja USA. A code issue vulnerability exists in Invoice Ninja version 5.12.38 and earlier, which stems from the incorrect manipulation of the parameter companylogo in the file /app/Jobs/Util/Import.php of the component Migration Import, whic...
📄 Invoice Ninja 5.8.22 PHP Code Injection
Invoice Ninja version 5.8.22 remote proof of concept exploit for a PHP code injection vulnerability. ============================================================================================================================================= | Title : Invoice Ninja v 5.8.22 PHP Code Injection...
EUVD-2017-1593
Malware in sbrugna...
EUVD-2021-20571
Malware in sbrugna...
EUVD-2025-1699
Malicious code in bioql PyPI...
EUVD-2025-30778
Malicious code in bioql PyPI...
CVE-2025-10009
Incorrect handling of uploaded files in the admin "Restore" function in Invoice Ninja = 5.11.72 allows attackers with admin credentials to execute arbitrary code on the server via uploaded .php files...
CVE-2025-10009
Incorrect handling of uploaded files in the admin "Restore" function in Invoice Ninja = 5.11.72 allows attackers with admin credentials to execute arbitrary code on the server via uploaded .php files...
Arbitrary File Upload
Overview hillelcoren/invoice-ninja is an Invoices, expenses & time-tracking built with Laravel Affected versions of this package are vulnerable to Arbitrary File Upload via the Restore process. An attacker can execute arbitrary code on the server by uploading specially crafted .php files when...
CVE-2025-10009 Authenticated admin RCE in Invoice Ninja
Incorrect handling of uploaded files in the admin "Restore" function in Invoice Ninja = 5.11.72 allows attackers with admin credentials to execute arbitrary code on the server via uploaded .php files...
CVE-2025-10009 Authenticated admin RCE in Invoice Ninja
Incorrect handling of uploaded files in the admin "Restore" function in Invoice Ninja = 5.11.72 allows attackers with admin credentials to execute arbitrary code on the server via uploaded .php files...
CVE-2025-10009 Authenticated admin RCE in Invoice Ninja
Incorrect handling of uploaded files in the admin "Restore" function in Invoice Ninja = 5.11.72 allows attackers with admin credentials to execute arbitrary code on the server via uploaded .php files...
CVE-2025-10009
CVE-2025-10009 affects Invoice Ninja (Laravel) up to version 5.11.72. The admin Restore function mishandles uploaded files, enabling an authenticated admin to upload .php files and potentially achieve arbitrary code execution on the server. Impact stated includes full remote code execution with h...
PT-2025-38704
Name of the Vulnerable Software and Affected Versions Invoice Ninja versions prior to 5.11.73 Description A flaw exists in the admin "Restore" function that allows attackers with admin credentials to execute arbitrary code on the server. This is possible through the upload of malicious .php files...
Invoice Ninja 安全漏洞
Invoice Ninja is an Invoice Ninja open source application with invoice, quote, project and time tracking capabilities. A security vulnerability exists in Invoice Ninja version 5.11.72 and earlier, which stems from the mishandling of uploaded files by the administrator recovery function and could...
Invoice Ninja 安全漏洞
Invoice Ninja is an Invoice Ninja open source application with invoice, quote, project and time tracking capabilities. A security vulnerability exists in Invoice Ninja versions prior to 5.0.175, which stems from improper authorization of the debugging tool and could allow a local attacker to read...
PT-2025-34758 · Unknown +1 · Invoice Ninja +1
Name of the Vulnerable Software and Affected Versions: Invoice Ninja versions prior to 5.0.175 Description: Invoice Ninja on macOS is susceptible to a local privilege escalation issue. The presence of the “com.apple.security.get-task-allow” entitlement allows local attackers with unprivileged...
