CVE-2026-110592 BottleCRM 0.30 through 1.14.5 HTML Injection via Custom Invoice PDF Template

BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in renderinvoicetemplate that allows authenticated organization members to inject markup into custom-template invoice PDFs. Attackers can place HTML and CSS in notes, terms, client name or address fields to overlay totals, pay...

CVE-2026-110592 BottleCRM 0.30 through 1.14.5 HTML Injection via Custom Invoice PDF Template

BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in renderinvoicetemplate that allows authenticated organization members to inject markup into custom-template invoice PDFs. Attackers can place HTML and CSS in notes, terms, client name or address fields to overlay totals, pay...

CVE-2026-110592: Improper Encoding or Escaping of Output

BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in renderinvoicetemplate that allows authenticated organization members to inject markup into custom-template invoice PDFs. Attackers can place HTML and CSS in notes, terms, client name or address fields to overlay totals, pay...

PT-2026-114034

🚨 CVE-2026-110592 BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in render invoice template that allows authenticated organization members to inject markup into custom-template invoice PDFs. Attackers can place HTML and CSS in notes, terms, client name or address fields to...

CVE-2026-2343

The PeproDev Ultimate Invoice WordPress plugin (versions through 2.2.5 ) is vulnerable to an unauthenticated invoice archive download vulnerability. The flaw exists in the bulk download invoices action, which generates ZIP archives containing exported invoice PDFs. Because these ZIP files are nam...