Lucene search
+L

1893 matches found

Kitploit
Kitploit
โ€ขadded 2026/09/12 11:42 p.m.โ€ข6 views

CVE-2026-54596

CVE-2026-54596 - Inyecciรณn SQL autenticada a travรฉs del parรกmetro recurringinvoicefrequency permite la exfiltraciรณn completa de la base de datos Severidad: Alta Aviso: GHSA-f9m3-qjc9-v27j Corregido en: Commit 7211426 Autor: iltosec Resumen Una vulnerabilidad de inyecciรณn SQL en el endpoint de...

6AI score
SaveExploits0References2
Kitploit
Kitploit
โ€ขadded 2026/09/12 3:08 p.m.โ€ข9 views

Crater-CVE-2023-46865-RCE

Crater-CVE-2023-46865-RCE Crater =6.0.6, CVE-2023-46865 RCE posterior a la autenticaciรณn Superadmin Descripciรณn de la Vulnerabilidad Crater Invoice es vulnerable a la subida de archivos sin restricciones con tipos peligrosos debido a la falta de validaciรณn adecuada de entrada. La clase de...

7.2CVSS7.3AI score0.20321EPSS
SaveExploits2
Kitploit
Kitploit
โ€ขadded 2026/09/12 11:22 a.m.โ€ข5 views

CVE-2022-43144-Stored-XSS

CVE-2022-43144 : XSS Almacenado Descripciรณn Una vulnerabilidad de cross-site scripting XSS en Canteen Management System v1.0 permite a atacantes ejecutar scripts web o HTML arbitrarios mediante un payload manipulado. Impacto Permite a un atacante secuestrar la sesiรณn del usuario y tomar el contro...

5.4CVSS6AI score0.00996EPSS
SaveExploits2
Kitploit
Kitploit
โ€ขadded 2026/09/12 9:09 a.m.โ€ข7 views

CVE-2024-55555

Laravel Crypto Killer Mass Scanner CVE-2024-55555 Este script realiza un escaneo masivo de aplicaciones basadas en Laravel vulnerables a CVE-2024-55555, una vulnerabilidad de ejecuciรณn remota de cรณdigo RCE no autenticada en Invoice Ninja. Automatiza el proceso de detecciรณn de sitios que utilizan...

8.8CVSS6.2AI score0.06611EPSS
SaveExploits5References1
Nuclei
Nuclei
โ€ขadded 2026/09/12 2:04 a.m.โ€ข42 views

WordPress Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Remote Code Execution

Print Invoice & Delivery Notes for WooCommerce plugin for WordPress = 5.8.0 contains a remote code execution caused by missing capability check, PHP enabled in Dompdf, and missing escape in template.php, letting unauthenticated attackers execute code on the server. id: CVE-2025-13773 info: name:...

9.8CVSS6.4AI score0.03766EPSS
SaveExploits0References3
CVE
CVE
โ€ขadded 2026/09/11 9:08 p.m.โ€ข41 views

CVE-2026-49865

Kimai , an open-source time tracking application, versions prior to 2.58.0 are affected by a Server-Side Request Forgery (SSRF) in the invoice PDF preview and generation workflow. The root cause is that user-controlled Markdown fields (e.g., Customer.invoiceText) pass through an md2html filter in...

5.3CVSS0.00327EPSS
SaveExploits1References1
OSV
OSV
โ€ขadded 2026/09/11 9:08 p.m.โ€ข5 views

CVE-2026-49865 Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain a server-side request forgery vulnerability in their invoice PDF preview and generation workflow. If an attacker can control Markdown content that is later rendered into an invoice PDF, such as Customer.invoiceTex...

5.3CVSS5.8AI score
SaveExploits0References3
NVD
NVD
โ€ขadded 2026/09/11 4:17 a.m.โ€ข5 views

CVE-2026-11496

The Woo PDF Invoice Builder plugin also distributed as "PDF Builder for WooCommerce" for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder AJAX handler woocommerce-pdf-invoice-ajax.php:513, registered on...

6.5CVSS0.00263EPSS
SaveExploits0References7
Cvelist
Cvelist
โ€ขadded 2026/09/11 3:39 a.m.โ€ข39 views

CVE-2026-11496 Woo PDF Invoice Builder <= 2.0.8 - Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Order Information Disclosure

The Woo PDF Invoice Builder plugin also distributed as "PDF Builder for WooCommerce" for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder AJAX handler woocommerce-pdf-invoice-ajax.php:513, registered on...

6.5CVSS0.00263EPSS
SaveExploits0References7
CVE
CVE
โ€ขadded 2026/09/11 3:39 a.m.โ€ข11 views

CVE-2026-11496

The Woo PDF Invoice Builder WordPress plugin (also distributed as "PDF Builder for WooCommerce") versions up to and including 2.0.8 are vulnerable to Insecure Direct Object Reference (IDOR) in the InspectOrder() AJAX handler (woocommerce-pdf-invoice-ajax.php:513), registered on wp_ajax_rednao_wcp...

6.5CVSS0.00263EPSS
SaveExploits0References7
EUVD
EUVD
โ€ขadded 2026/09/11 3:39 a.m.โ€ข8 views

EUVD-2026-75929

The Woo PDF Invoice Builder plugin also distributed as "PDF Builder for WooCommerce" for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder AJAX handler woocommerce-pdf-invoice-ajax.php:513, registered on...

6.5CVSS0.00263EPSS
SaveExploits0References7
Kitploit
Kitploit
โ€ขadded 2026/09/10 1:30 a.m.โ€ข9 views

CVE-2026-25596

CVE-2026-25596 โ€” Stored XSS via Product Unit Name in InvoicePlane 1.7.0 Vulnerability: Stored Cross-Site Scripting XSS via Product Unit Name field Product: InvoicePlane Affected Version: 1.7.0 and likely prior versions Severity: Medium CVSS 3.1 Score: 4.8...

4.8CVSS5.8AI score0.0021EPSS
SaveExploits2
Kitploit
Kitploit
โ€ขadded 2026/09/10 1:30 a.m.โ€ข8 views

CVE-2026-25595

CVE-2026-25595 โ€” InvoicePlane 1.7.0์˜ ์†ก์žฅ ๋ฒˆํ˜ธ๋ฅผ ํ†ตํ•œ ์ €์žฅํ˜• XSS ์ทจ์•ฝ์ : ์†ก์žฅ ๋ฒˆํ˜ธ ํ•„๋“œ๋ฅผ ํ†ตํ•œ ์ €์žฅํ˜• ๊ต์ฐจ ์‚ฌ์ดํŠธ ์Šคํฌ๋ฆฝํŒ…XSS ์ œํ’ˆ: InvoicePlane ์˜ํ–ฅ์„ ๋ฐ›๋Š” ๋ฒ„์ „: 1.7.0๋ฐ ์ด์ „ ๋ฒ„์ „์ผ ๊ฐ€๋Šฅ์„ฑ ์žˆ์Œ ์‹ฌ๊ฐ๋„: ์ค‘๊ฐ„ CVSS 3.1 ์ ์ˆ˜: 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CWE: CWE-79: ์›น ํŽ˜์ด์ง€ ์ƒ์„ฑ ์ค‘ ์ž…๋ ฅ์˜ ๋ถ€์ ์ ˆํ•œ ์ค‘ํ™” ๋ฐœ๊ฒฌ์ž: Leonidas Agathos ๋ณด๊ณ  ๋‚ ์งœ: 2026-01-31 ์„ค๋ช… ์†ก์žฅ ์–‘์‹์˜...

4.8CVSS5.8AI score0.0021EPSS
SaveExploits2
EUVD
EUVD
โ€ขadded 2026/09/10 12:30 a.m.โ€ข6 views

EUVD-2026-75213

A security vulnerability has been detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This affects an unknown part of the file includes/invoicebill.php of the component Invoice Generation. Such manipulation of the argument orderdate/invoiceno leads to...

6.9CVSS0.00448EPSS
SaveExploits0References7
NVD
NVD
โ€ขadded 2026/09/09 11:16 p.m.โ€ข8 views

CVE-2026-87924

A security vulnerability has been detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This affects an unknown part of the file includes/invoicebill.php of the component Invoice Generation. Such manipulation of the argument orderdate/invoiceno leads to...

6.9CVSS0.00448EPSS
SaveExploits0References6
CVE
CVE
โ€ขadded 2026/09/09 10:45 p.m.โ€ข10 views

CVE-2026-87924

CVE-2026-87924 affects the Rizwan17 inventory-management-system (GitHub) up to commit bfe78a330d01bb26b9daec5dc9ecd5c77900e03f . The vulnerability resides in includes/invoice_bill.php within the Invoice Generation component. Manipulation of the order_date and invoice_no arguments results in missi...

6.9CVSS0.00448EPSS
SaveExploits0References6
Kitploit
Kitploit
โ€ขadded 2026/09/09 9:19 p.m.โ€ข6 views

CVE-2025-55903

CVE-2025-55903: Stored HTML Injection in PerfexCRM โš ๏ธ Security Advisory A critical Stored HTML Injection vulnerability affecting invoices, billing, and automated communications -ff6600 ๐Ÿ“‹ Overview A Stored HTML Injection vulnerability has been discovered in PerfexCRM that allows authenticated users...

8.3CVSS5.9AI score0.00337EPSS
SaveExploits0
Kitploit
Kitploit
โ€ขadded 2026/09/09 8:00 p.m.โ€ข9 views

CVE-2025-60378

CVE-2025-60378: Stored HTML Injection in RISE Ultimate Project Manager & CRM โš ๏ธ Security Advisory A critical Stored HTML Injection vulnerability affecting invoices, messaging, and automated communications -ff6600 ๐Ÿ“‹ Overview A critical Stored HTML Injection vulnerability has been discovered in RISE...

8.1CVSS5.9AI score0.01079EPSS
SaveExploits1
Kitploit
Kitploit
โ€ขadded 2026/09/07 3:59 p.m.โ€ข6 views

CVE-2025-68428_PoC

CVE-2025-68428PoC root@kitploit: $ git clone https://github.com/12nio/CVE-2025-68428PoC/ && cd CVE-2025-68428PoC $ sudo docker build -t poc . $ sudo docker run --rm -p 8080:8080 --name vuln poc $ curl "http://127.0.0.1:8080/api/v1/generate-invoice?client=Dinko&branding=../secret" --output poc.pdf...

9.2CVSS7.8AI score0.02177EPSS
SaveExploits2References1
NVD
NVD
โ€ขadded 2026/09/04 8:17 p.m.โ€ข5 views

CVE-2026-71626

An issue in Invoice Ninja v5.13.24 allows a remote attacker to obtain sensitive information via the StoreWebhookRequest.php, UpdateWebhookRequest.php, and WebhookSingle.php components...

7.5CVSS0.00315EPSS
SaveExploits0References2
Rows per page
Query Builder