CVE-2026-71233

Summary

The flaw allows an attacker to inject malicious HTML into the client portal by exploiting the raw output directive in the 'terms' field, leading to Cross-Site Scripting (XSS).

Exploitability

Exploitation is relatively easy given the public exploit references and the lack of HTML sanitization. The attacker needs access to the 'terms' field input.

Blast radius

If exploited, the XSS could lead to session hijacking, data theft, or other client-side attacks affecting all users of the client portal.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to the latest version of InvoiceNinja v5-stable or apply the vendor's patch immediately.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.