WordPress Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Remote Code Execution

Print Invoice & Delivery Notes for WooCommerce plugin for WordPress = 5.8.0 contains a remote code execution caused by missing capability check, PHP enabled in Dompdf, and missing escape in template.php, letting unauthenticated attackers execute code on the server. id: CVE-2025-13773 info: name:...

CVE-2022-43144-Stored-XSS

CVE-2022-43144 : XSS stocké Stored-XSS Description Une vulnérabilité de cross-site scripting XSS dans Canteen Management System v1.0 permet à un attaquant d'exécuter des scripts web ou du HTML arbitraire via une charge utile payload spécialement conçue. Impact Permettre à un attaquant de détourne...

CVE-2024-55555

Scanner di Massa Laravel Crypto Killer CVE-2024-55555 Questo script esegue una scansione di massa di applicazioni basate su Laravel vulnerabili a CVE-2024-55555, una vulnerabilità di esecuzione remota di codice RCE non autenticata in Invoice Ninja. Automatizza il processo di rilevamento di siti c...

Crater-CVE-2023-46865-RCE

Crater-CVE-2023-46865-RCE Crater =6.0.6, CVE-2023-46865 Post-Auth RCE Superadmin Descrizione della vulnerabilità Crater Invoice è vulnerabile al caricamento di file senza restrizioni con tipo pericoloso a causa della mancanza di una corretta validazione dell'input. La classe di controllo Base64Mi...

CVE-2026-25596

CVE-2026-25596 — XSS persistente tramite il campo Nome Unità di Prodotto in InvoicePlane 1.7.0 Vulnerabilità: Cross-Site Scripting XSS persistente tramite il campo Nome Unità di Prodotto Prodotto: InvoicePlane Versione interessata: 1.7.0 e probabilmente versioni precedenti Gravità: Media Punteggi...

CVE-2026-25595

CVE-2026-25595 — Stored XSS über die Rechnungsnummer in InvoicePlane 1.7.0 Schwachstelle: Stored Cross-Site Scripting XSS über das Feld Rechnungsnummer Produkt: InvoicePlane Betroffene Version: 1.7.0 und vermutlich frühere Versionen Schweregrad: Mittel CVSS 3.1-Score: 4.8...

CVE-2025-60378

CVE-2025-60378: Iniezione HTML Persistente in RISE Ultimate Project Manager & CRM ⚠️ Avviso di Sicurezza Una vulnerabilità critica di Iniezione HTML Persistente che interessa fatture, messaggistica e comunicazioni automatizzate -ff6600 📋 Panoramica È stata scoperta una vulnerabilità critica di...

CVE-2025-55903

CVE-2025-55903: Iniezione HTML Persistente in PerfexCRM ⚠️ Avviso di Sicurezza Una vulnerabilità critica di Iniezione HTML Persistente che interessa fatture, indirizzi di fatturazione e comunicazioni automatizzate -ff6600 📋 Panoramica È stata scoperta una vulnerabilità di Iniezione HTML Persistent...

CVE-2026-54596

CVE-2026-54596 - Injection SQL Authentifiée via le Paramètre recurringinvoicefrequency Permet l'Exfiltration Complète de la Base de Données Gravité : Élevée Avis : GHSA-f9m3-qjc9-v27j Corrigé dans : Commit 7211426 Auteur : iltosec Résumé Une vulnérabilité d'injection SQL dans le point de...

CVE-2025-68428_PoC

CVE-2025-68428PoC root@kitploit: $ git clone https://github.com/12nio/CVE-2025-68428PoC/ && cd CVE-2025-68428PoC $ sudo docker build -t poc . $ sudo docker run --rm -p 8080:8080 --name vuln poc $ curl "http://127.0.0.1:8080/api/v1/generate-invoice?client=Dinko&branding=../secret" --output poc.pdf...

CVE-2026-80201

Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken and getPlainApiToken methods. Attackers with template creation permissions can embed these method calls in invoice templates to leak hashed API tokens in rendered...

CVE-2026-80201 Kimai before 2.53.0 API Token Leakage via Invoice Template

Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken and getPlainApiToken methods. Attackers with template creation permissions can embed these method calls in invoice templates to leak hashed API tokens in rendered...

CVE-2026-80201

Kimai before 2.53.0 fails to block sensitive User methods within its Twig invoice template sandbox , allowing privileged users to invoke getApiToken() and getPlainApiToken(). Attackers holding template creation permissions can embed these method calls in invoice templates, causing hashed API toke...

CVE-2026-80201 Kimai before 2.53.0 API Token Leakage via Invoice Template

Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken and getPlainApiToken methods. Attackers with template creation permissions can embed these method calls in invoice templates to leak hashed API tokens in rendered...

CVE-2026-57863

Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit...

CVE-2026-57863

Crater Invoice (through 6.0.6 ) contains a path traversal vulnerability in its self-update API. The root cause is unsanitized ZIP entry names containing ../ sequences passed to PHP's ZipArchive::extractTo(), allowing authenticated company owners to write arbitrary files outside the intended extra...

CVE-2026-57863 Crater Invoice 6.0.6 Path Traversal RCE via update/unzip endpoint

Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit...

EUVD-2026-65478

Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit...

CVE-2026-57863 Crater Invoice 6.0.6 Path Traversal RCE via update/unzip endpoint

Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit...

PT-2026-81914

Name of the Vulnerable Software and Affected Versions Kimai versions prior to 2.53.0 Description The Twig invoice template sandbox fails to block sensitive User methods. This allows users with template creation permissions to call the getApiToken and getPlainApiToken functions, leading to the...