PT-2026-84113 · Unknown · Invoice Ninja
CVSS v2.0
6.5
Medium
| Vector | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Invoice Ninja versions prior to 5.13.27
Description
An authorization bypass exists in the Vendor Portal Profile Update component within the
/vedor/profile/ file. A remote attacker can exploit this by manipulating the vendor contact argument.Recommendations
Upgrade to version 5.13.27.
Exploit
Fix
Improper Authorization
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Invoice Ninja