CVE-2024-55555

Invoice Ninja before 5.10.43 allows remote code execution from a pre-authenticated route when an attacker knows the APPKEY. This is exacerbated by .env files, available from the product's repository, that have default APPKEY values. The route/hash route defined in the invoiceninja/routes/client.p...

CVE-2021-33898

In Invoice Ninja before 4.4.0, there is an unsafe call to unserialize in app/Ninja/Repositories/AccountRepository.php that may allow an attacker to deserialize arbitrary PHP classes. In certain contexts, this can result in remote code execution. The attacker's input must be hosted at...

CVE-2017-1000466

Invoice Ninja version 3.8.1 is vulnerable to stored cross-site scripting vulnerability, within the invoice creation page, which can result in disruption of service and execution of javascript code...

Invoice Ninja 5.10.10 Insecure Deserialization / Remote Code Execution

Invoice Ninja versions 5.8.22 through 5.10.10 allows for remote code execution by leveraging a PHP deserialization vulnerability. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Invoice Ninja...

Invoice Ninja 5.10.10 Insecure Deserialization / Remote Code Execution Exploit

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Invoice Ninja unauthenticated PHP Deserialization Vulnerability', 'Description' = %q Invoice Ninja is a free invoicing software for small...

CVE-2025-0474

Invoice Ninja is vulnerable to authenticated Server-Side Request Forgery SSRF allowing for arbitrary file read and network resource requests as the application user. This issue affects Invoice Ninja: from 5.8.56 through 5.11.23...

Server-side Request Forgery (SSRF)

Overview hillelcoren/invoice-ninja is an Invoices, expenses & time-tracking built with Laravel Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the PDF rendering functionality. Remediation Upgrade hillelcoren/invoice-ninja to version 5.11.8 or higher...

CVE-2025-0474

Invoice Ninja is vulnerable to authenticated Server-Side Request Forgery SSRF allowing for arbitrary file read and network resource requests as the application user. This issue affects Invoice Ninja: from 5.8.56 through 5.11.23...

CVE-2025-0474 Invoice Ninja PDF Rendering Server Side Request Forgery

Invoice Ninja is vulnerable to authenticated Server-Side Request Forgery SSRF allowing for arbitrary file read and network resource requests as the application user. This issue affects Invoice Ninja: from 5.8.56 through 5.11.23...

CVE-2025-0474

CVE-2025-0474 affects Invoice Ninja versions 5.8.56–5.11.23 and describes an authenticated SSRF that enables arbitrary file reads and network-resource requests by the application user. Connected sources corroborate the vulnerability class and affected versions. Public materials indicate the impac...

CVE-2025-0474 Invoice Ninja PDF Rendering Server Side Request Forgery

Invoice Ninja is vulnerable to authenticated Server-Side Request Forgery SSRF allowing for arbitrary file read and network resource requests as the application user. This issue affects Invoice Ninja: from 5.8.56 through 5.11.23...

CVE-2025-0474 Invoice Ninja PDF Rendering Server Side Request Forgery

Invoice Ninja is vulnerable to authenticated Server-Side Request Forgery SSRF allowing for arbitrary file read and network resource requests as the application user. This issue affects Invoice Ninja: from 5.8.56 through 5.11.23...

PT-2025-3907 · Unknown · Invoice Ninja

Name of the Vulnerable Software and Affected Versions: Invoice Ninja versions 5.8.56 through 5.11.23 Description: Invoice Ninja is vulnerable to authenticated Server-Side Request Forgery SSRF, allowing for arbitrary file read and network resource requests as the application user. This issue enabl...

Invoice Ninja 代码问题漏洞

Invoice Ninja is an available invoice, quote, project and time tracking application built with Laravel by Invoice Ninja open source. A code issue vulnerability exists in Invoice Ninja versions 5.8.56 through 5.11.23. An attacker can exploit the vulnerability to read arbitrary files and request...

CVE-2024-55555

Invoice Ninja before 5.10.43 allows remote code execution from a pre-authenticated route when an attacker knows the APPKEY. This is exacerbated by .env files, available from the product's repository, that have default APPKEY values. The route/hash route defined in the invoiceninja/routes/client.p...

CVE-2024-55555

Invoice Ninja before 5.10.43 allows remote code execution from a pre-authenticated route when an attacker knows the APPKEY. This is exacerbated by .env files, available from the product's repository, that have default APPKEY values. The route/hash route defined in the invoiceninja/routes/client.p...

CVE-2024-55555

Invoice Ninja before 5.10.43 allows remote code execution from a pre-authenticated route when an attacker knows the APPKEY. This is exacerbated by .env files, available from the product's repository, that have default APPKEY values. The route/hash route defined in the invoiceninja/routes/client.p...

CVE-2024-55555

Technical details (affected versions, vulnerable components, impact scope, and fixes) are not publicly provided in the supplied documents. Monitor for updates.

CVE-2024-55555

Invoice Ninja before 5.10.43 allows remote code execution from a pre-authenticated route when an attacker knows the APPKEY. This is exacerbated by .env files, available from the product's repository, that have default APPKEY values. The route/hash route defined in the invoiceninja/routes/client.p...

Invoice Ninja 代码问题漏洞

Invoice Ninja is Invoice Ninja open source a usable invoice, quote, project and time tracking application built using Laravel. A code issue vulnerability exists in Invoice Ninja versions prior to 5.10.43. An attacker exploiting this vulnerability could remotely execute commands...