invoice ninja vulnerabilities and fixes

Recent CVEs affecting invoice ninja, with upgrade or downgrade steps. 3 tracked.

Also searched as: invoiceninja.

invoice ninja has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2026-03-30. Highest priority: CVE-2026-29925 (score 38/100).

• CVE-2026-33742 MEDIUM 5.4 UPGRADE Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel
• CVE-2026-33628 MEDIUM 5.4 UPGRADE Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel
• CVE-2026-29925 HIGH 7.7 DOWNGRADE Invoice Ninja v5.12.46 and v5.12.48 is vulnerable to Server-Side Request Forgery (SSRF) in CheckDatabaseReques

FAQ

How do I fix invoice ninja vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is invoice ninja being exploited right now?

None of the tracked invoice ninja CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which invoice ninja CVE should I patch first?

CVE-2026-29925 currently ranks highest (38/100): Invoice Ninja v5.12.46 and v5.12.48 is vulnerable to Server-Side Request Forgery (SSRF) in CheckDatabaseReques.

RSS feed for invoice ninja · ← Back to latest CVEs