2259 matches found
PT-2025-7384
Name of the Vulnerable Software and Affected Versions PeproDev Ultimate Invoice plugin for WordPress versions up to, and including, 2.0.8 Description The issue concerns an Insecure Direct Object Reference vulnerability in the PeproDev Ultimate Invoice plugin for WordPress. This vulnerability aris...
CVE-2024-13719: Missing Authorization
The PeproDev Ultimate Invoice plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.9 via the invoicing viewer due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view invoices for...
WordPress PeproDev Ultimate Invoice plugin <= 2.0.9 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Tim Coen in WordPress Plugin PeproDev Ultimate Invoice versions = 2.0.9...
Fake Etsy invoice scam tricks sellers into sharing credit card information
This article was researched and written by Stefan Dasic, manager, research and response forThreatDown, powered by Malwarebytes. As an online seller, you’re already juggling product listings, customer service and marketing—so the last thing you need is to be targeted by scammers. Unfortunately, a...
CVE-2025-22364
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Service Shogun Ach Invoice App ach-invoice-app allows PHP Local File Inclusion.This issue affects Ach Invoice App: from n/a through = 1.0.1...
CVE-2025-0474
Invoice Ninja is vulnerable to authenticated Server-Side Request Forgery SSRF allowing for arbitrary file read and network resource requests as the application user. This issue affects Invoice Ninja: from 5.8.56 through 5.11.23...
CVE-2022-1033
Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6...
CVE-2022-1032
Insecure deserialization of not validated module file in GitHub repository crater-invoice/crater prior to 6.0.6...
CVE-2022-0203
Improper Access Control in GitHub repository crater-invoice/crater prior to 6.0.2...
CVE-2024-54328
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in linknacional Invoice Payment for WooCommerce invoice-payment-for-woocommerce allows Reflected XSS.This issue affects Invoice Payment for WooCommerce: from n/a through = 1.7.2...
WordPress PDF Invoice Builder for WooCommerce plugin <= 4.6.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by theviper17 in WordPress Plugin PDF Invoice Builder for WooCommerce versions = 4.6.0...
CVE-2025-24755: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-woocommerce allows Stored XSS.This issue affects PDF Invoice Builder for WooCommerce: from n/a through = 4.6.0...
CVE-2023-46401
KWHotel 0.47 is vulnerable to CSV Formula Injection in the invoice adding function...
CVE-2023-46401
KWHotel 0.47 is vulnerable to CSV Formula Injection in the invoice adding function...
PT-2025-1511 · Kwhotel · Kwhotel
Name of the Vulnerable Software and Affected Versions: KWHotel version 0.47 Description: The issue concerns CSV Formula Injection in the invoice adding function. This allows for potential exploitation through malicious formula injection in CSV files. Recommendations: For KWHotel version 0.47,...
KWHotel 安全漏洞
KWHotel is a hotel software for desktop, web and mobile devices from KWHotel, Inc. A security vulnerability exists in KWHotel version 0.47, which stems from a CSV formula injection in the Add Invoice feature...
CVE-2023-46401
KWHotel 0.47 is vulnerable to CSV Formula Injection in the invoice adding function...
CVE-2023-46401
KWHotel 0.47 is vulnerable to CSV Formula Injection in the invoice adding function...
CVE-2023-46401
KWHotel 0.47 is vulnerable to CSV Formula Injection in the invoice adding function. Affected product: KWHotel (desktop/web/mobile) version 0.47. Root cause: CSV formula injection in the Add Invoice feature. Impact is described as high for confidentiality, integrity, and availability per CVE metri...