PT-2026-114034 · Micropyramid · Bottlecrm
CVE-2026-110592
·
Published
2026-10-14
·
Updated
2026-10-14
CVSS v3.1
3.5
Low
| Vector | AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N |
BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in render invoice template() that allows authenticated organization members to inject markup into custom-template invoice PDFs. Attackers can place HTML and CSS in notes, terms, client name or address fields to overlay totals, payee and payment instructions in PDFs served via download, public links and emails.
Exploit
Fix
Improper Encoding or Escaping of Output
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Bottlecrm