Vendors / invoiceninja Records 14 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 0
CVSS high 6
Exploited now invoiceninja records in CISA KEV No invoiceninja vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 67
Invoice Ninja v5.12.46 and v5.12.48 is vulnerable to Server-Side Request Forgery (SSRF) in CheckDatabaseRequest.php.
CVSS 3.1 HIGH 7.7· Network · Low privileges · No interaction · EPSS 0.0032 · Published 2026-03-30 · No fix listed CWE-918
Priority MEDIUM 58
Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel.
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00209 · Published 2026-03-26 · Fixed in 5.13.4 CWE-79
Priority MEDIUM 58
Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel.
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.0024 · Published 2026-03-26 · Fixed in 5.13.4 CWE-116
Priority LOW 39
In Invoice Ninja before 4.4.0, there is an unsafe call to unserialize() in app/Ninja/Repositories/AccountRepository.php that may allow an attacker to deserialize arbitrary PHP classes.
CVSS 3.1 HIGH 8.1· Network · No auth · No interaction · EPSS 0.01804 · Published 2021-06-06 · No fix listed CWE-502
Priority LOW 26
Invoice Ninja version 3.8.1 is vulnerable to stored cross-site scripting vulnerability, within the invoice creation page, which can result in disruption of service and execution of javascript code.
CVSS 3.0 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.0079 · Published 2018-01-03 · No fix listed CWE-79
Priority LOW 25
invoiceninja is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00612 · Published 2021-12-24 · Fixed in v.5.33, 5.3.35 CWE-79
Open these records in search → All records by CVSS severity
0 6 8 0 0
THREATIST.IORead the docs