CVE-2026-14791
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A cross-site scripting vulnerability has been found in Crater Invoice Inc up to version 6.0.6 in the getFormattedString function of app/Http/Requests/InvoicesRequest.php. Manipulating the notes argument in the Invoice Note Handler component can lead to script execution in the browser. The attack is remotely exploitable and the exploit is public.
Risk Assessment
An attacker can inject malicious script into invoice notes, potentially leading to session theft, account takeover, or data leakage. The risk is high because the exploit is publicly available and the project has not responded to the report.
Recommendation
Immediately upgrade Crater Invoice Inc to a version above 6.0.6 if available, or apply temporary mitigations such as input filtering and output encoding for the notes parameter. Monitor for official patches.
Original NVD description (English source)
A weakness has been identified in crater-invoice-inc crater up to 6.0.6. This affects the function getFormattedString of the file app/Http/Requests/InvoicesRequest.php of the component Invoice Note Handler. Executing a manipulation of the argument notes can lead to cross site scripting. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.