PT-2024-35730 · Unknown · Invoice Ninja

Name of the Vulnerable Software and Affected Versions: Invoice Ninja affected versions not specified Description: A Server-Side Request Forgery SSRF issue has been discovered in Invoice Ninja, an open-source invoicing platform. This flaw could allow attackers to access sensitive files, posing...

Invoice Ninja unauthenticated PHP Deserialization Vulnerability

Invoice Ninja is a free invoicing software for small businesses, based on the PHP framework Laravel. A Remote Code Execution vulnerability in Invoice Ninja = 5.8.22 which accepts a Laravel ciphered value which is unsafe unserialized, if an attacker has access to the APPKEY. As it allows remote co...

PT-2024-36551 · Unknown · Invoice Ninja

Name of the Vulnerable Software and Affected Versions: Invoice Ninja versions prior to 5.10.43 Description: The issue allows remote code execution from a pre-authenticated route when an attacker knows the APP KEY. This is exacerbated by .env files that have default APP KEY values. The route...

CVE-2021-3977

invoiceninja is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

The vulnerability of the unserialize() function of the Invoice Ninja software allows a perpetrator to execute arbitrary code.

The vulnerability of the unserialize function in the Invoice Ninja software’s app/Ninja/Repositories/AccountRepository.php file involves the restoration of unreliable data in memory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

CVE-2021-33898

In Invoice Ninja before 4.4.0, there is an unsafe call to unserialize in app/Ninja/Repositories/AccountRepository.php that may allow an attacker to deserialize arbitrary PHP classes. In certain contexts, this can result in remote code execution. The attacker's input must be hosted at...

CVE-2021-33898

In Invoice Ninja before 4.4.0, there is an unsafe call to unserialize in app/Ninja/Repositories/AccountRepository.php that may allow an attacker to deserialize arbitrary PHP classes. In certain contexts, this can result in remote code execution. The attacker's input must be hosted at...

CVE-2021-33898

In Invoice Ninja before 4.4.0, there is an unsafe call to unserialize in app/Ninja/Repositories/AccountRepository.php that may allow an attacker to deserialize arbitrary PHP classes. In certain contexts, this can result in remote code execution. The attacker's input must be hosted at...

Design/Logic Flaw

In Invoice Ninja before 4.4.0, there is an unsafe call to unserialize in app/Ninja/Repositories/AccountRepository.php that may allow an attacker to deserialize arbitrary PHP classes. In certain contexts, this can result in remote code execution. The attacker's input must be hosted at...

CVE-2021-33898

Invoice Ninja before 4.4.0 has an unsafe unserialize() call in app/Ninja/Repositories/AccountRepository.php which can let an attacker deserialize arbitrary PHP classes. In certain contexts this may lead to remote code execution. The attack input is tied to http://www.geoplugin.net (plain HTTP), a...

CVE-2021-33898

In Invoice Ninja before 4.4.0, there is an unsafe call to unserialize in app/Ninja/Repositories/AccountRepository.php that may allow an attacker to deserialize arbitrary PHP classes. In certain contexts, this can result in remote code execution. The attacker's input must be hosted at...

Invoice Ninja 代码问题漏洞

invoiceninja is a Github open source application an open source invoice application built with Laravel and Flutter Invoice Ninja has a security vulnerability before 4.4.0 that allows an attacker to deserialize arbitrary PHP classes...

Cross site scripting

Invoice Ninja version 3.8.1 is vulnerable to stored cross-site scripting vulnerability, within the invoice creation page, which can result in disruption of service and execution of javascript code...

CVE-2017-1000466

Invoice Ninja version 3.8.1 is vulnerable to stored cross-site scripting vulnerability, within the invoice creation page, which can result in disruption of service and execution of javascript code...

CVE-2017-1000466

Invoice Ninja version 3.8.1 is vulnerable to stored cross-site scripting vulnerability, within the invoice creation page, which can result in disruption of service and execution of javascript code...

CVE-2017-1000466

Invoice Ninja version 3.8.1 is vulnerable to stored cross-site scripting vulnerability, within the invoice creation page, which can result in disruption of service and execution of javascript code...

CVE-2017-1000466

CVE-2017-1000466 concerns Invoice Ninja v3.8.1, where a stored cross-site scripting (XSS) vulnerability exists on the invoice creation page. The underlying issue is embedded script execution triggered by user-supplied content, enabling potential disruption of service and JavaScript execution with...

Invoice Ninja Cross-Site Scripting Vulnerability

Invoice Ninja is an open source financial system. The system is able to provide invoicing, collection and other functions. A cross-site scripting vulnerability exists in the invoice creation page in Invoice Ninja version 3.8.1. A remote attacker can exploit this vulnerability to cause a denial of...