← Database

CVE-2026-71233

HIGH CVSS: 8.7 Published: 2026-08-05 Modified: 2026-08-10

Description

InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive {!! ->terms !!} (resources/views/portal/ninja2020/invoices/includes/terms.blade.php) with no HTML sanitization.

Affected Platforms

Unknown

Weakness Type

CWE-79

References