PT-2026-28521 · Unknown+1 · Invoice Ninja+1

Morimori-Dev · Publicado 2026-03-26 · Atualizado 2026-03-26 · CVE-2026-33742

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Invoice Ninja versions 5.13.0 through 5.13.3

Description Invoice Ninja, an invoice, quote, project, and time-tracking application built with Laravel, has an issue where the product notes fields in versions 5.13.0 through 5.13.3 allow raw HTML through Markdown rendering, potentially leading to stored cross-site scripting (XSS). The Markdown parser's output was not properly sanitized using the purify::clean() function before being included in invoice templates. This could allow an attacker to inject malicious code into the system.

Recommendations Update to version 5.13.4 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-33742

GHSA-XPH7-9749-56MH

Produtos afetados

Invoice Ninja

Laravel

Referências · 6

• 🔥 https://github.com/invoiceninja/invoiceninja/security/advisories/GHSA-xph7-9749-56mh · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33742.json · Exploit
• https://github.com/invoiceninja/invoiceninja/releases/tag/v5.13.4 · Nota
• https://twitter.com/CVEnew/status/2037280526823022964 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-33742 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33742 · Nota de Segurança