Unknown · Solidinvoice · CVE-2025-9170
**Name of the Vulnerable Software and Affected Versions:**
SolidInvoice versions prior to 2.4.1
**Description:**
A vulnerability exists in SolidInvoice that allows for cross site scripting. The issue is located in an unknown `function` within the `/tax/rates` file of the Tax Rates Module. Manipulation of the `Name` parameter can trigger the vulnerability, and the attack can be executed remotely. The exploit is publicly available. The vendor was contacted regarding this issue but did not respond.
**Recommendations:**
SolidInvoice versions prior to 2.4.1: Update to version 2.4.1 or later to resolve this issue. As a temporary workaround, consider restricting access to the `/tax/rates` file or disabling the Tax Rates Module until a patch is available.