CVE-2026-7092
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A vulnerability has been found in code-projects Invoice System in Laravel 1.0, affecting an unknown function of the /profile/ file in the Profile Handler component. Manipulation of the ID argument leads to improper authorization, and the attack can be performed remotely. The exploit has been publicly disclosed and may be used.
Risk Assessment
Improper authorization could allow an attacker to access other users' profiles or modify data. Public availability of the exploit increases the risk of exploitation.
Recommendation
Apply fixes or mitigations for the Profile Handler component, ensuring proper permission verification. Consider restricting application access to trusted networks.
Other vulnerabilities in code-projects Invoice System in Laravel
See all- CVE-2026-7110Low
In code-projects Invoice System in Laravel 1.0, manipulation of the item name/description argument in the /item file leads to cross-site scripting. The attack can be launched remotely, and the exploit has been published and may be used.
- CVE-2026-7108Medium
A security vulnerability has been detected in code-projects Invoice System in Laravel 1.0. It affects an unknown function and leads to cross-site request forgery. The attack may be performed remotely, and the exploit has been disclosed publicly and may be used.
- CVE-2026-7107Medium
A weakness has been identified in code-projects Invoice System in Laravel 1.0. The impacted element is an unknown function of the file /company. This manipulation of the argument logo causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
- CVE-2026-7093Medium
A vulnerability was found in code-projects Invoice System in Laravel 1.0. Affected by this vulnerability is an unknown functionality of the file /invoice/ of the component Invoice Endpoint. Performing a manipulation of the argument ID results in improper authorization. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
- CVE-2026-7091Medium
A flaw has been found in code-projects Invoice System in Laravel 1.0, impacting an unknown function of the /user file in the User Management Handler component. Manipulation causes improper authorization, and remote exploitation is possible. The exploit has been published and may be used.
Original NVD description (English source)
A vulnerability has been found in code-projects Invoice System in Laravel 1.0. Affected is an unknown function of the file /profile/ of the component Profile Handler. Such manipulation of the argument ID leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS