HIGH
CVE-2026-71233
CVSS
8.7
Description
InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive {!! ->terms !!} (resources/views/portal/ninja2020/invoices/includes/terms.blade.php) with no HTML sanitization.
Weakness (CWE)
CWE-79
Cross-site Scripting (XSS)
EPSS Score
0.2%
Probability of exploitation in next 30 days
10th percentile
References
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.