What’s Vulnerable › Vulnerabilities

CVE-2021-3977: Cross-site Scripting (XSS) - Stored in invoiceninja/invoiceninja

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-12-24 · updated 2026-06-17
• Weakness: CWE-79

Description

invoiceninja is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

• invoiceninja: before 4.5.47; from 5.0 before 5.3.33 — fixed in 4.5.47, 5.3.33

How to fix

Upgrade to a fixed version: invoiceninja 4.5.47, 5.3.33. Check the vendor advisory for mitigations.

References

• https://github.com/invoiceninja/invoiceninja/commit/1186eaa82375692d01d5ef3369c5b7bc7315b55f
• https://huntr.dev/bounties/99c4ed09-b66f-474a-bd74-eeccf9339fde
• https://github.com/invoiceninja/invoiceninja/commit/1186eaa82375692d01d5ef3369c5b7bc7315b55f
• https://huntr.dev/bounties/99c4ed09-b66f-474a-bd74-eeccf9339fde

Get alerted when CVE-2021-3977 or the next vulnerability affects your stack