PT-2026-29095 · Unknown · Invoice Ninja

Treklaps · CVE-2026-29925 · Publicado 2026-03-30 · Atualizado 2026-03-30

Positive Technologies (AI Summary)

CVSS v3.1

7.7

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Invoice Ninja versions 5.12.46 and 5.12.48

Description Invoice Ninja versions 5.12.46 and 5.12.48 are susceptible to a Server-Side Request Forgery (SSRF) condition. This issue is located in the CheckDatabaseRequest.php file. SSRF occurs when an application makes requests to unintended locations, potentially exposing sensitive data or allowing unauthorized actions.

Recommendations Update Invoice Ninja to a version newer than 5.12.48. Update Invoice Ninja to a version newer than 5.12.46.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-29925

Produtos afetados

Invoice Ninja

Referências · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29925.json · Exploit
• 🔥 https://gist.github.com/TrekLaps/5b2c72106d950dab0cd1897eb93200f1 · Exploit
• https://github.com/invoiceninja/invoiceninja/blob/v5-stable/app/Http/Requests/Setup/CheckDatabaseRequest.php · Nota
• https://osv.dev/vulnerability/CVE-2026-29925 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-29925 · Nota de Segurança