CVE-2023-46401

KWHotel 0.47 is vulnerable to CSV Formula Injection in the invoice adding function. Affected product: KWHotel (desktop/web/mobile) version 0.47. Root cause: CSV formula injection in the Add Invoice feature. Impact is described as high for confidentiality, integrity, and availability per CVE metri...

Server-side Request Forgery (SSRF)

Overview hillelcoren/invoice-ninja is an Invoices, expenses & time-tracking built with Laravel Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the PDF rendering functionality. Remediation Upgrade hillelcoren/invoice-ninja to version 5.11.8 or higher...

CVE-2025-0474

Invoice Ninja is vulnerable to authenticated Server-Side Request Forgery SSRF allowing for arbitrary file read and network resource requests as the application user. This issue affects Invoice Ninja: from 5.8.56 through 5.11.23...

CVE-2025-0474 Invoice Ninja PDF Rendering Server Side Request Forgery

Invoice Ninja is vulnerable to authenticated Server-Side Request Forgery SSRF allowing for arbitrary file read and network resource requests as the application user. This issue affects Invoice Ninja: from 5.8.56 through 5.11.23...

CVE-2025-0474

CVE-2025-0474 affects Invoice Ninja versions 5.8.56–5.11.23 and describes an authenticated SSRF that enables arbitrary file reads and network-resource requests by the application user. Connected sources corroborate the vulnerability class and affected versions. Public materials indicate the impac...

CVE-2025-0474 Invoice Ninja PDF Rendering Server Side Request Forgery

Invoice Ninja is vulnerable to authenticated Server-Side Request Forgery SSRF allowing for arbitrary file read and network resource requests as the application user. This issue affects Invoice Ninja: from 5.8.56 through 5.11.23...

CVE-2025-0474 Invoice Ninja PDF Rendering Server Side Request Forgery

Invoice Ninja is vulnerable to authenticated Server-Side Request Forgery SSRF allowing for arbitrary file read and network resource requests as the application user. This issue affects Invoice Ninja: from 5.8.56 through 5.11.23...

PT-2025-3907 · Unknown · Invoice Ninja

Name of the Vulnerable Software and Affected Versions: Invoice Ninja versions 5.8.56 through 5.11.23 Description: Invoice Ninja is vulnerable to authenticated Server-Side Request Forgery SSRF, allowing for arbitrary file read and network resource requests as the application user. This issue enabl...

Invoice Ninja 代码问题漏洞

Invoice Ninja is an available invoice, quote, project and time tracking application built with Laravel by Invoice Ninja open source. A code issue vulnerability exists in Invoice Ninja versions 5.8.56 through 5.11.23. An attacker can exploit the vulnerability to read arbitrary files and request...

CVE-2024-55555

Invoice Ninja before 5.10.43 allows remote code execution from a pre-authenticated route when an attacker knows the APPKEY. This is exacerbated by .env files, available from the product's repository, that have default APPKEY values. The route/hash route defined in the invoiceninja/routes/client.p...

CVE-2024-55556

A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APPKEY to achieve remote command execution on the server by manipulating the laravelsession cookie, exploiting arbitrary deserialization through the encrypted session data. The exploitation vector of this...

CVE-2024-55556

A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APPKEY to achieve remote command execution on the server by manipulating the laravelsession cookie, exploiting arbitrary deserialization through the encrypted session data. The exploitation vector of this...

CVE-2025-22364

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Service Shogun Ach Invoice App ach-invoice-app allows PHP Local File Inclusion.This issue affects Ach Invoice App: from n/a through = 1.0.1...

CVE-2025-22364

CVE-2025-22364 affects ACH Invoicing Plugin (Ach Invoice App) for WordPress, with impact due to an Unauthenticated Local File Inclusion (LFI) via Improper Control of Filename for Include/Require in PHP. Documented as affected from n/a to 1.0.1. Red Hat and Wordfence sources concur it is Unpatched...

CVE-2025-22364 WordPress Ach Invoice App plugin <= 1.0.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Service Shogun Ach Invoice App ach-invoice-app allows PHP Local File Inclusion.This issue affects Ach Invoice App: from n/a through = 1.0.1...

CVE-2025-22364 WordPress Ach Invoice App plugin <= 1.0.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Service Shogun Ach Invoice App allows PHP Local File Inclusion.This issue affects Ach Invoice App: from n/a through 1.0.1...

WordPress plugin Ach Invoice App 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-55555

Invoice Ninja before 5.10.43 allows remote code execution from a pre-authenticated route when an attacker knows the APPKEY. This is exacerbated by .env files, available from the product's repository, that have default APPKEY values. The route/hash route defined in the invoiceninja/routes/client.p...

CVE-2024-55555

Invoice Ninja before 5.10.43 allows remote code execution from a pre-authenticated route when an attacker knows the APPKEY. This is exacerbated by .env files, available from the product's repository, that have default APPKEY values. The route/hash route defined in the invoiceninja/routes/client.p...

CVE-2024-55556

A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APPKEY to achieve remote command execution on the server by manipulating the laravelsession cookie, exploiting arbitrary deserialization through the encrypted session data. The exploitation vector of this...