What’s Vulnerable › Products

invoiceninja vulnerabilities

10 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your invoiceninja version is affected

Latest invoiceninja vulnerabilities

• CVE-2026-83744 — invoiceninja Invoice Ninja invoices Endpoint Purify.php isHostSafe server-side request forgery (CVSS 4.3)
• CVE-2026-83743 — invoiceninja Invoice Ninja Vendor Portal Profile Update profile authorization (CVSS 6.3)
• CVE-2026-71233 — InvoiceNinja - Stored XSS via Invoice/Quote Terms Field (CVSS 8.7)
• CVE-2026-58450 — Invoice Ninja 5.13.26 - Open Redirect in Client Portal Login via intended Parameter (CVSS 4.3)
• CVE-2026-29925 — (CVSS 7.7)
• CVE-2026-33742 — Invoice Ninja has Stored XSS via Markdown HTML Injection in Product Notes (CVSS 5.4)
• CVE-2026-33628 — Invoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line Items (CVSS 5.4)
• CVE-2021-3977 — Cross-site Scripting (XSS) - Stored in invoiceninja/invoiceninja (CVSS 5.4)
• CVE-2021-33898 — (CVSS 8.1)
• CVE-2017-1000466 — (CVSS 5.4)