{"id":"CVE-2026-71233","published":"2026-08-05T11:16:25.997","lastModified":"2026-08-10T12:17:25.770","description":"InvoiceNinja v5-stable renders an invoice or quote's \"terms\" field in the client portal using Laravel Blade's raw output directive {!! ->terms !!} (resources/views/portal/ninja2020/invoices/includes/terms.blade.php) with no HTML sanitization.","cvssScore":8.7,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://github.com/invoiceninja/invoiceninja","tags":[]}],"exploitRefs":[{"url":"https://github.com/invoiceninja/invoiceninja","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows untrusted input to be executed as HTML in the client portal, enabling cross-site scripting (XSS) attacks.","exploitability":"Exploitation is relatively easy if an attacker can inject malicious scripts into the 'terms' field, requiring access to modify invoice data.","blast_radius":"If exploited, this could lead to unauthorized data theft or manipulation of displayed content for all clients accessing the portal.","remediation":"Implement proper HTML sanitization before rendering user input in the Blade template.","tags":["xss","html-sanitization","web","sanitization"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-08-11T06:48:04.356Z"}}