PT-2026-114034 · Micropyramid · Bottlecrm
CVE-2026-110592
·
Publicado
2026-10-14
·
Atualizado
2026-10-14
CVSS v3.1
3.5
Baixa
| Vetor | AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N |
BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in render invoice template() that allows authenticated organization members to inject markup into custom-template invoice PDFs. Attackers can place HTML and CSS in notes, terms, client name or address fields to overlay totals, payee and payment instructions in PDFs served via download, public links and emails.
Exploit
Correção
Improper Encoding or Escaping of Output
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Bottlecrm