PT-2026-27631 · Unknown · Invoice Ninja
Morimori-Dev
·
Published
2026-03-24
·
Updated
2026-03-26
·
CVE-2026-33628
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Invoice Ninja versions 5.13.0 through 5.13.3
Description
Invoice Ninja allows for the execution of stored cross-site scripting (XSS) payloads through invoice line item descriptions in versions 5.13.0 through 5.13.3. The line item description field did not undergo proper sanitization using
purify::clean() before rendering, enabling attackers to inject malicious code. An attacker, any authenticated user capable of creating invoices, can exploit this to target any user viewing the invoice, including clients accessing the portal. Potential consequences include session hijacking, account takeover, and data exfiltration. The vulnerable parameter is the line item description field. The vulnerable function is the rendering process of invoices in the PDF preview and client portal.Recommendations
Upgrade to version 5.13.4 or later to benefit from the fix, which implements
purify::clean() to sanitize line item descriptions.Exploit
Fix
XSS
Incomplete List of Disallowed Inputs
Improper Encoding or Escaping of Output
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Invoice Ninja