CVE-2026-110592

BottleCRM versions 0.30 through 1.14.5 are vulnerable to an HTML injection flaw within the render_invoice_template() function. This vulnerability allows authenticated organization members to inject malicious HTML and CSS markup into custom-template invoice PDFs by inputting specific strings into ...