Log in Start free

invoiceninja

Products

ProductCVEsExploitedLatest
invoiceninja5–Nov 4, 2026
Invoice Ninja2–Sep 1, 2026
invoiceninja/invoiceninja1–Dec 24, 2021

Exploited and recent CVEs

  • CVE-2026-82029 Medium 6.5 Invoice Ninja < 5.13.28 Broken Access Control via Vendor Portal 0.2%
  • CVE-2026-83744 Medium 4.3 invoiceninja Invoice Ninja invoices Endpoint Purify.php isHostSafe server-side request forgery 0.3%
  • CVE-2026-83743 Medium 6.3 invoiceninja Invoice Ninja Vendor Portal Profile Update profile authorization 0.4%
  • CVE-2026-71233 High 8.7 InvoiceNinja - Stored XSS via Invoice/Quote Terms Field 0.4%
  • CVE-2026-58450 Medium 4.3 Invoice Ninja 5.13.26 - Open Redirect in Client Portal Login via intended Parameter 0.3%
  • CVE-2026-33742 Medium 5.4 Invoice Ninja has Stored XSS via Markdown HTML Injection in Product Notes 0.2%
  • CVE-2026-33628 Medium 5.4 Invoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line Items 0.2%
  • CVE-2021-3977 Medium 6.5 Cross-site Scripting (XSS) - Stored in invoiceninja/invoiceninja 0.6%