CyberRota Analysis
AI-GeneratedThe vulnerability affects InvoiceNinja v5-stable, where the "terms" field in invoices is rendered without proper HTML sanitization, allowing authenticated users to inject malicious HTML/JavaScript via the REST API. This can lead to cross-site scripting (XSS) attacks, enabling session cookie theft and potential account takeover for clients viewing the invoice. Organizations using this version of InvoiceNinja should prioritize patching this vulnerability to protect their users from exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive {!! ->terms !!} (resources/views/portal/ninja2020/invoices/includes/terms.blade.php) with no HTML sanitization.