Invoice Ninja vulnerabilities
We track 2 vulnerabilities in Invoice Ninja products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 22, 2025.
2vulnerabilities
0critical
2high
0exploited
8.2average CVSS score
Latest Invoice Ninja vulnerabilities
- 8.6 High severity
Invoice Ninja 5: Unrestricted Upload of File with Dangerous Type
Incorrect handling of uploaded files in the admin "Restore" function in Invoice Ninja <= 5.11.72 allows attackers with admin credentials to execute arbitrary code on the server via uploaded .php files.
- 7.7 High severity
Invoice Ninja: Server-Side Request Forgery
Invoice Ninja is vulnerable to authenticated Server-Side Request Forgery (SSRF) allowing for arbitrary file read and network resource requests as the application user. This issue affects Invoice Ninja: from 5.8.56 through 5.11.23.