Skip to content
OpenAdvisories
Medium · 6.5 CVE-2021-3977 EUVD-2022-0741GHSA-xg6r-5gx4-qxjm

Cross-site Scripting (XSS) - Stored in invoiceninja/invoiceninja

Published Dec 24, 2021 · Updated Aug 3, 2024 · Assigned by @huntrdev

Vendor: Invoice Ninja Product: invoiceninja/invoiceninja Package: hillelcoren/invoice-ninja Ecosystem: Packagist

Description

invoiceninja is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

VendorProductAffectedFixed
invoiceninja invoiceninja/invoiceninja unspecified – < v.5.33 v.5.33

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist hillelcoren/invoice-ninja < 5.3.35 5.3.35 GHSA-xg6r-5gx4-qxjm

References