CVE-2026-110592

BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in renderinvoicetemplate that allows authenticated organization members to inject markup into custom-template invoice PDFs. Attackers can place HTML and CSS in notes, terms, client name or address fields to overlay totals, pay...

CVE-2026-110592

BottleCRM versions 0.30 through 1.14.5 are vulnerable to an HTML injection flaw within the render_invoice_template() function. This vulnerability allows authenticated organization members to inject malicious HTML and CSS markup into custom-template invoice PDFs by inputting specific strings into ...