Skip to contentInvoiceninja vulnerabilities
Newest
- invoiceninjaInvoice Ninja < 5.13.28 Broken Access Control via Vendor PortalCVE-2026-820297.1 High
- invoice ninja ninja, invoiceninja invoice ninja +1 moreinvoiceninja Invoice Ninja invoices Endpoint Purify.php isHostSafe server-side request forgeryCVE-2026-837445.3 Medium
- invoice ninja ninja, invoiceninja invoice ninja +1 moreinvoiceninja Invoice Ninja Vendor Portal Profile Update profile authorizationCVE-2026-837435.3 Medium
- invoiceninjaInvoiceNinja - Stored XSS via Invoice/Quote Terms FieldCVE-2026-712338.7 High
- invoiceninjaInvoice Ninja 5.13.26 - Open Redirect in Client Portal Login via intended ParameterCVE-2026-584505.3 Medium
- invoiceninja invoice ninjaInvoice Ninja v5.12.46 and v5.12.48 is vulnerable to Server-Side Request Forgery (SSRF) in...CVE-2026-299257.7 High
- invoiceninja invoice ninja, invoiceninja +1 moreInvoice Ninja has Stored XSS via Markdown HTML Injection in Product NotesCVE-2026-337425.4 Medium
- invoiceninja invoice ninja, invoiceninja +1 moreInvoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line ItemsCVE-2026-33628Fix available5.4 Medium
- invoiceninjainvoiceninja Migration Import Import.php copy server-side request forgeryCVE-2026-06495.1 Medium
- invoiceninja invoiceninja/invoiceninja, invoice ninja +1 moreCross-site Scripting (XSS) - Stored in invoiceninja/invoiceninjaCVE-2021-3977Fix available6.5 Medium
- invoiceninja invoice ninjaIn Invoice Ninja before 4.4.0, there is an unsafe call to unserialize() in app/Ninja/Repositories...CVE-2021-338988.1 High
- invoiceninja invoice ninjaInvoice Ninja version 3.8.1 is vulnerable to stored cross-site scripting vulnerability, within...CVE-2017-10004665.4 Medium