GCVE - cpe:2.3:a:invoiceninja:invoice_ninja:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:invoiceninja:invoice_ninja:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Invoiceninja (`35a6f006-e570-5a3e-8534-58722d7d2394`)
Product	Invoice Ninja (`38753940-3207-59cf-859e-e0fcaca60b8b`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/invoiceninja/invoiceninja`	purl2cpe	2026-06-01 10:15:05.227847

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-58450`	vulnerable	2026-07-29 01:03:16.815221	Invoice Ninja 5.13.26 - Open Redirect in Client Portal Login via intended Parameter MEDIUM (4.3) Invoice Ninja through 5.13.26 contains an open redirect vulnerability in the client portal login that allows unauthenticated attackers to redirect authenticated victims to attacker-controlled external URLs by injecting a malicious value into the intended query parameter. Attackers can craft a client login link with an external URL in the intended parameter, which is stored in the session without host validation and emitted verbatim via a bare redirect in the ContactLoginController authenticated() handler after the victim completes a legitimate login, enabling phishing attacks. Published: 2026-06-30T21:07:25.092Z Updated: 2026-07-14T22:03:04.945Z Open on db.gcve.eu Reference links https://github.com/invoiceninja/invoiceninja/issues/12039 https://www.vulncheck.com/advisories/invoice-ninja-open-redirect-in-client-portal-login-via-intended-parameter	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-33742`	vulnerable	2026-06-08 07:59:10.683458	Invoice Ninja has Stored XSS via Markdown HTML Injection in Product Notes MEDIUM (5.4) Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Product notes fields in Invoice Ninja v5.13.0 allow raw HTML via Markdown rendering, enabling stored XSS. The Markdown parser output was not sanitized with `purify::clean()` before being included in invoice templates. This is fixed in v5.13.4 by the vendor by adding `purify::clean()` to sanitize Markdown output. Published: 2026-03-26T20:50:21.984Z Updated: 2026-03-27T13:55:25.963Z Open on db.gcve.eu Reference links https://github.com/invoiceninja/invoiceninja/security/advisories/GHSA-xph7-9749-56mh https://github.com/invoiceninja/invoiceninja/releases/tag/v5.13.4	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-33628`	vulnerable	2026-06-08 07:59:10.500705	Invoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line Items MEDIUM (5.4) Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Invoice line item descriptions in Invoice Ninja v5.13.0 bypass the XSS denylist filter, allowing stored XSS payloads to execute when invoices are rendered in the PDF preview or client portal. The line item description field was not passed through `purify::clean()` before rendering. This is fixed in v5.13.4 by the vendor by adding `purify::clean()` to sanitize line item descriptions. Published: 2026-03-26T20:48:45.739Z Updated: 2026-03-27T13:55:36.614Z Open on db.gcve.eu Reference links https://github.com/invoiceninja/invoiceninja/security/advisories/GHSA-98wm-cxpw-847p https://github.com/invoiceninja/invoiceninja/commit/b81a3fc302573fc4a53d61e8537dd19154ce1091 https://github.com/invoiceninja/invoiceninja/releases/tag/v5.13.4	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-0474`	vulnerable	2026-06-08 07:02:24.667016	Invoice Ninja PDF Rendering Server Side Request Forgery HIGH (7.7) Invoice Ninja is vulnerable to authenticated Server-Side Request Forgery (SSRF) allowing for arbitrary file read and network resource requests as the application user. This issue affects Invoice Ninja: from 5.8.56 through 5.11.23. Published: 2025-01-14T18:50:30.331Z Updated: 2026-07-14T22:25:31.874Z Open on db.gcve.eu Reference links https://github.com/invoiceninja/invoiceninja/commit/2a9bf353b432d7060e85487b617151ecbc36247d https://vulncheck.com/advisories/invoice-ninja-ssrf https://github.com/invoiceninja/invoiceninja/compare/97ae948618230c1812f3223b80bf22dcb0382dc5..435780932fe19063001d79ba518815df62773d71	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-3977`	vulnerable	2026-06-08 05:33:58.357655	Cross-site Scripting (XSS) - Stored in invoiceninja/invoiceninja MEDIUM (6.5) invoiceninja is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Published: 2021-12-24T20:10:10.000Z Updated: 2024-08-03T17:09:09.688Z Open on db.gcve.eu Reference links https://huntr.dev/bounties/99c4ed09-b66f-474a-bd74-eeccf9339fde https://github.com/invoiceninja/invoiceninja/commit/1186eaa82375692d01d5ef3369c5b7bc7315b55f	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-33898`	vulnerable	2026-06-08 05:32:12.630960	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.