Crater-Invoice 10 CVEs across 2 Crater-Invoice products. Browse Crater-Invoice vulnerabilities, severities, and proof-of-concept exploits.
Crater-Invoice products with known CVEs Crater-Invoice CVEs — newest first CVE Severity Score Published Summary CVE-2026-71242High 8.32026-08-05 Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and ot… CVE-2026-55739High 8.32026-08-05 Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and ->hasCompany(->company_id). Cus… CVE-2022-1032High 7.22022-03-29 Insecure deserialization of not validated module file in GitHub repository crater-invoice/crater prior to 6.0.6. CVE-2022-1033High 7.82022-03-23 Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6. CVE-2022-0515Medium 4.32022-03-21 Cross-Site Request Forgery (CSRF) in GitHub repository crater-invoice/crater prior to 6.0.4. CVE-2022-0514Medium 6.52022-03-21 Business Logic Errors in GitHub repository crater-invoice/crater prior to 6.0.5. CVE-2022-0372Medium 5.42022-01-27 Cross-site Scripting (XSS) - Stored in Packagist bytefury/crater prior to 6.0.2. CVE-2022-0203Medium 5.32022-01-26 Improper Access Control in GitHub repository crater-invoice/crater prior to 6.0.2. CVE-2022-0242High 7.22022-01-17 Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0. CVE-2021-4080High 8.82022-01-12 crater is vulnerable to Unrestricted Upload of File with Dangerous Type