CVE-2024-55555

In versions prior to 5.10.43 , Invoice Ninja is vulnerable to unauthenticated remote code execution (RCE) via a PHP deserialization flaw. The vulnerability exists in the route/{hash} route (defined in invoiceninja/routes/client.php), which allows unauthenticated access. An attacker who possesses ...