CVE-2025-0474

Published Jan 14, 2025

Last updated a month ago

Overview

Description: Invoice Ninja is vulnerable to authenticated Server-Side Request Forgery (SSRF) allowing for arbitrary file read and network resource requests as the application user. This issue affects Invoice Ninja: from 5.8.56 through 5.11.23.
Source: disclosure@vulncheck.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.7
Impact score: 4
Exploitability score: 3.1
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Severity: HIGH

Weaknesses

disclosure@vulncheck.com: CWE-918

Hype score: Not currently trending

CVE-2025-0474 is the number. 🥳 Crazy happy to earn my first CVE number. It was a joint effort with @TheLaluka during the @OffenSkillCorp level 30 training. Learned a bunch and had lots of fun. What more can one ask for? 😃 #hacking #bugbounty #cve
@brank0x42
16 Jan 2025
12 Impressions
0 Retweets
0 Likes
0 Bookmarks
1 Reply
0 Quotes

References