Vulnerabilidades de Crater-invoice-inc
CVEs publicadas que afetam produtos de Crater-invoice-inc: 2 registro(s), com severidade, exploração e correções.
CVE-2026-57863
Alta · 8.8
CWE-22 25/08/2026
Crater Invoice 6.0.6 Path Traversal RCE via update/unzip endpoint
Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit unsanitized ZIP entry names passed to PHP's ZipArchive::extractTo() to write arbitrary PHP files into the web-accessible public directory and achieve remote code execution on the server.
CVE-2026-14791
Baixa · 3.5
CWE-79 06/07/2026
crater-invoice-inc crater Invoice Note InvoicesRequest.php getFormattedString cross site scripting
A weakness has been identified in crater-invoice-inc crater up to 6.0.6. This affects the function getFormattedString of the file app/Http/Requests/InvoicesRequest.php of the component Invoice Note Handler. Executing a manipulation of the argument notes can lead to cross site scripting. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.