CVE-2024-55555

Laravel Crypto Killer Mass Scanner CVE-2024-55555 This script performs a mass scan of Laravel-based applications vulnerable to CVE-2024-55555, an unauthenticated remote code execution RCE vulnerability in Invoice Ninja. It automates the process of detecting sites using weak or known APPKEY values...

Crater-CVE-2023-46865-RCE

Crater-CVE-2023-46865-RCE Crater =6.0.6, CVE-2023-46865 Post-Auth RCE Superadmin Vulnerability Description Crater Invoice is vulnerable to unrestricted file upload with dangerous type due to lack of proper input validation. The Base64Mime checking class can be bypassed by embedding a valid PHP...

CVE-2022-43144-Stored-XSS

CVE-2022-43144 : XSS Almacenado Descripción Una vulnerabilidad de cross-site scripting XSS en Canteen Management System v1.0 permite a atacantes ejecutar scripts web o HTML arbitrarios mediante un payload manipulado. Impacto Permite a un atacante secuestrar la sesión del usuario y tomar el contro...

WordPress Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Remote Code Execution

Print Invoice & Delivery Notes for WooCommerce plugin for WordPress = 5.8.0 contains a remote code execution caused by missing capability check, PHP enabled in Dompdf, and missing escape in template.php, letting unauthenticated attackers execute code on the server. id: CVE-2025-13773 info: name:...

CVE-2026-94432

The Appointment Booking Plugin – LatePoint for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to and including 5.7.1 . The flaw exists in the OsPaypalConnectController::create_order_for_transaction() action, which is exposed as an unauthenticated route via wp...

PT-2026-104140

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.1 via the OsPaypalConnectController::create order for transaction action registered as a public...

WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration vulnerability

Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration vulnerability discovered by Niv Kochan, Matan Bachar in WordPress Plugin LatePoint versions = 5.7.1...

CVE-2026-25596

CVE-2026-25596 — XSS Almacenado a través del Nombre de Unidad de Producto en InvoicePlane 1.7.0 Vulnerabilidad: Cross-Site Scripting XSS Almacenado a través del campo Nombre de Unidad de Producto Producto: InvoicePlane Versión afectada: 1.7.0 y probablemente versiones anteriores Severidad: Media...

CVE-2026-25595

CVE-2026-25595 — XSS Almacenado a través del Número de Factura en InvoicePlane 1.7.0 Vulnerabilidad: Cross-Site Scripting XSS Almacenado a través del campo Número de Factura Producto: InvoicePlane Versión Afectada: 1.7.0 y probablemente versiones anteriores Gravedad: Media Puntuación CVSS 3.1: 4....

CVE-2025-60378

CVE-2025-60378: Inyección de HTML Almacenado en RISE Ultimate Project Manager & CRM ⚠️ Aviso de Seguridad Una vulnerabilidad crítica de inyección de HTML almacenado que afecta a facturas, mensajería y comunicaciones automatizadas -ff6600 📋 Resumen Se ha descubierto una vulnerabilidad crítica de...

CVE-2025-55903

CVE-2025-55903: Inyección de HTML Almacenado en PerfexCRM ⚠️ Aviso de Seguridad Una vulnerabilidad crítica de Inyección de HTML Almacenado que afecta a facturas, facturación y comunicaciones automatizadas -ff6600 📋 Resumen Se ha descubierto una vulnerabilidad de Inyección de HTML Almacenado en...

CVE-2026-101139

A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotel...

CVE-2026-101139 Webkul Bagisto Invoice Mass Status Update state authorization

A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotel...

CVE-2026-101139 Webkul Bagisto Invoice Mass Status Update state authorization

A vulnerability was detected in Webkul Bagisto up to 2.4.6. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotely. The explo...

EUVD-2026-88444

A vulnerability was detected in Webkul Bagisto up to 2.4.6. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotely. The explo...

CVE-2026-101139

A vulnerability exists in Webkul Bagisto up to version 2.4.6 within the Invoice Mass Status Update component. The issue impacts an unknown function of the file /admin/sales/invoices/mass-update/state, where performing a manipulation leads to missing authorization . This flaw can be exploited remo...

CVE-2026-101139 Webkul Bagisto Invoice Mass Status Update state authorization

A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotel...

CVE-2025-68428_PoC

CVE-2025-68428PoC $ git clone https://github.com/12nio/CVE-2025-68428PoC/ && cd CVE-2025-68428PoC $ sudo docker build -t poc . $ sudo docker run --rm -p 8080:8080 --name vuln poc $ curl "http://127.0.0.1:8080/api/v1/generate-invoice?client=Dinko&branding=../secret" --output poc.pdf...

CVE-2026-101139: Missing Authorization

A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotel...

CVE-2026-54596

CVE-2026-54596 - Authenticated SQL Injection via recurringinvoicefrequency Parameter Enables Full Database Exfiltration Severity: High Advisory: GHSA-f9m3-qjc9-v27j Fixed in: Commit 7211426 Author: iltosec Summary An SQL injection vulnerability in ITFlow's recurring invoice creation endpoint allo...