Vulnerability · Published Apr 27, 2026 · Assigned by VulDB
CVE-2026-7093code-projects Invoice System in Laravel Invoice Endpoint invoice improper authorization
Medium 6.3
In plain English
A medium-severity security flaw in Invoice System in Laravel from code-projects. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Official description
A vulnerability was found in code-projects Invoice System in Laravel 1.0. Affected by this vulnerability is an unknown functionality of the file /invoice/ of the component Invoice Endpoint. Performing a manipulation of the argument ID results in improper authorization. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| code-projects | Invoice System in Laravel | 1.0 |
Weakness: CWE-285, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-359668 | code-projects Invoice System in Laravel Invoice Endpoint invoice improper authorization vdb-entry, technical-description
- VDB-359668 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #800389 | code-projects Invoice System in Laravel 1.0 Invoice System in Laravel third-party-advisory
- https://gist.github.com/higordiego/1d1a2b84768e4f80c673bd27be32c256 exploit
- https://code-projects.org/ product