2167 matches found
CVE-2026-19350
A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performed from remote. The name of the patch is...
CVE-2026-19350 Dolibarr ERP TakePOS invoice.php fail authorization
A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performed from remote. The name of the patch is...
CVE-2026-19350 Dolibarr ERP TakePOS invoice.php fail authorization
A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performed from remote. The name of the patch is...
CVE-2026-19350 Dolibarr ERP TakePOS invoice.php fail authorization
A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performed from remote. The name of the patch is...
CVE-2026-19350
Dolibarr ERP TakePOS module vulnerability CVE-2026-19350 affects the function fail in htdocs/takepos/invoice.php. The issue enables manipulation that leads to missing authorization, with remote exploitation potential. A patch identified as 8992ce8704da947b6abe7b65a6fe59aed736bb81 is available; ap...
CVE-2026-12901 GetPaid < 2.8.55 - Unauthenticated Worldpay Payment Bypass via Insufficient IPN Verification
The GetPaid WordPress plugin before 2.8.55 does not verify the authenticity of incoming Worldpay payment notifications, allowing unauthenticated attackers to forge a notification that marks a pending invoice as paid without any payment being made...
CVE-2026-12901 GetPaid < 2.8.55 - Unauthenticated Worldpay Payment Bypass via Insufficient IPN Verification
The GetPaid WordPress plugin before 2.8.55 does not verify the authenticity of incoming Worldpay payment notifications, allowing unauthenticated attackers to forge a notification that marks a pending invoice as paid without any payment being made...
CVE-2026-12901: Insufficient Verification of Data Authenticity
The GetPaid WordPress plugin before 2.8.55 does not verify the authenticity of incoming Worldpay payment notifications, allowing unauthenticated attackers to forge a notification that marks a pending invoice as paid without any payment being made...
CVE-2026-71233
InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive !! -terms !! resources/views/portal/ninja2020/invoices/includes/terms.blade.php with no HTML sanitization...
EUVD-2026-53306
InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive !! $entity-terms !! resources/views/portal/ninja2020/invoices/includes/terms.blade.php with no HTML sanitization. StoreInvoiceRequest.php only strips newlines from th...
CVE-2026-71233 InvoiceNinja - Stored XSS via Invoice/Quote Terms Field
InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive !! -terms !! resources/views/portal/ninja2020/invoices/includes/terms.blade.php with no HTML sanitization...
CVE-2026-71233
InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive !! $entity-terms !! resources/views/portal/ninja2020/invoices/includes/terms.blade.php with no HTML sanitization. StoreInvoiceRequest.php only strips newlines from th...
CVE-2026-71233 InvoiceNinja - Stored XSS via Invoice/Quote Terms Field
InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive !! -terms !! resources/views/portal/ninja2020/invoices/includes/terms.blade.php with no HTML sanitization...
CVE-2026-71233
CVE-2026-71233 affects InvoiceNinja v5-stable: the client portal renders the invoice/quote terms with Laravel Blade's raw output (resources/views/portal/ninja2020/invoices/includes/terms.blade.php) and no HTML sanitization. StoreInvoiceRequest.php only strips newlines, not HTML purification. An a...
CVE-2026-55739
Crater isolates data per companyid, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and -hasCompany-companyid. CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability. Route-model-bound custome...
Silver Fox Targets Japanese Manufacturer with 3-Driver BYOVD Chain and ValleyRAT
The Chinese cybercrime group known as Silver Fox has been observed using new drivers as part of bring your own vulnerable driver BYOVD attacks targeting a Japanese organization in the industrial manufacturing sector to ultimately deliver ValleyRAT aka Winos 4.0 for persistent remote access. "In...
EUVD-2026-49689
The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax function and the serveTemplatePdf REST route which is registered...
CVE-2026-12124: Missing Authorization
The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax function and the serveTemplatePdf REST route which is registered...