InvoiceNinja v5.0.0 contains a Cross-site Scripting vulnerability that allows authenticated users to execute arbitrary scripts in the client portal, posing a significant risk to user session security.

The application uses the Laravel Blade {!! !!} directive to render the terms field, which fails to sanitize input, allowing an authenticated user with sufficient privileges to inject malicious scripts that execute in the context of other users.

With a CVSS score of 8.7, this XSS flaw facilitates session hijacking, unauthorized account actions, and potential data theft from the client portal. Such compromises can lead to severe reputational damage and the loss of sensitive financial or client data.

Immediate Action: Review vendor documentation for the latest stable release and apply all available security updates to address the improper rendering of user input.

Proactive Monitoring: Inspect web application logs for suspicious script injection patterns in invoice or quote templates and monitor for unauthorized portal access attempts.

Compensating Controls: Utilize a Web Application Firewall (WAF) with robust XSS filtering rules to detect and block malicious payloads submitted via the invoice terms field.

Public Exploit Available: Unknown

Security teams should treat this XSS vulnerability as a priority, particularly for public-facing portals. Immediate remediation through software updates is essential to prevent session-based attacks that could lead to unauthorized data access or platform manipulation.