TaxHacker vulnerabilities

2 known vulnerabilities in TaxHacker from Vas3k. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.3 High severity

  TaxHacker: Server-Side Request Forgery

  CVE-2026-94039Sep 20, 2026Vas3k

  A vulnerability was detected in vas3k TaxHacker up to 0.8.5. Affected is the function generateInvoicePDF of the file /apps/invoices/actions.ts of the component Invoice PDF Renderer. Performing a manipulation of the argument businessLogo results in server-side

• 7.3 High severity

  TaxHacker: Use of Hard-coded Password

  CVE-2026-78062Aug 23, 2026Vas3k

  A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The affected element is the function envSchema.parse of the file lib/config.ts of the component JWT Secret Handler. The manipulation of the argument BETTER_AUTH_SECRET leads to hard-coded credentia