← Volver a CVEs

CVE-2026-33628

MEDIUM

5.4

Descripcion

Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Invoice line item descriptions in Invoice Ninja v5.13.0 bypass the XSS denylist filter, allowing stored XSS payloads to execute when invoices are rendered in the PDF preview or client portal. The line item description field was not passed through `purify::clean()` before rendering. This is fixed in v5.13.4 by the vendor by adding `purify::clean()` to sanitize line item descriptions.

Detalles CVE

Puntuacion CVSS v3.15.4

SeveridadMEDIUM

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosLOW

Interaccion usuarioREQUIRED

Publicado3/26/2026

Ultima modificacion3/30/2026

Fuentenvd

Avistamientos honeypot0

Productos afectados

invoiceninja:invoice_ninja

Debilidades (CWE)

CWE-79CWE-116CWE-184CWE-79

Referencias

https://github.com/invoiceninja/invoiceninja/commit/b81a3fc302573fc4a53d61e8537dd19154ce1091(security-advisories@github.com)

https://github.com/invoiceninja/invoiceninja/releases/tag/v5.13.4(security-advisories@github.com)

https://github.com/invoiceninja/invoiceninja/security/advisories/GHSA-98wm-cxpw-847p(security-advisories@github.com)

https://github.com/invoiceninja/invoiceninja/security/advisories/GHSA-98wm-cxpw-847p(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.