Invoiceninja Invoice Ninja
6 CVEs affecting Invoiceninja Invoice Ninja. Latest disclosed: 2026-03-30. Critical: 0, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-33898 | High | 8.1 | 2021-06-06 | In Invoice Ninja before 4.4.0, there is an unsafe call to unserialize() in app/Ninja/Repositories/AccountRepository.php that may allow an attacker to deseriali… |
CVE-2026-29925 | High | 7.7 | 2026-03-30 | Invoice Ninja v5.12.46 and v5.12.48 is vulnerable to Server-Side Request Forgery (SSRF) in CheckDatabaseRequest.php. |
CVE-2026-33742 | Medium | 5.4 | 2026-03-26 | Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Product notes fields in Invoice Ninja v5.13.0 allow raw H… |
CVE-2026-33628 | Medium | 5.4 | 2026-03-26 | Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Invoice line item descriptions in Invoice Ninja v5.13.0 b… |
CVE-2021-3977 | Medium | 5.4 | 2021-12-24 | invoiceninja is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2017-1000466 | Medium | 5.4 | 2018-01-03 | Invoice Ninja version 3.8.1 is vulnerable to stored cross-site scripting vulnerability, within the invoice creation page, which can result in disruption of ser… |