CVE-2026-58450

MEDIUM4.3

Published 2026-06-30 · Updated 2026-07-14 · Source disclosure@vulncheck.com

Description

Invoice Ninja through 5.13.26 contains an open redirect vulnerability in the client portal login that allows unauthenticated attackers to redirect authenticated victims to attacker-controlled external URLs by injecting a malicious value into the intended query parameter. Attackers can craft a client login link with an external URL in the intended parameter, which is stored in the session without host validation and emitted verbatim via a bare redirect in the ContactLoginController authenticated() handler after the victim completes a legitimate login, enabling phishing attacks.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

CWE-601

References

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-72588
A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address is registered. The POST /api/v1/auth/recovery/request endpoint returns HTTP 200 for registered email addresses and a different status code for unregistered ones, enabling attackers to enumerate valid user accounts.
2026-08-10 · score 5.3
CVE-2026-72587
A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the u query parameter of the GET /_instatic/hole/<nodeId> server island endpoint. The originating-page URL supplied in u seeds the route template frame used for rendering, and the result is stored in a shared cache keyed only on nodeId, enabling an attacker to inject a crafted route that causes all subsequent visitors to receive malformed or attacker-controlled fragment content.
2026-08-10 · score 6.1
CVE-2026-72585
An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points (receivers) without the required alert.notifications.receivers.protected:write permission. The fix for CVE-2026-21724 addressed only the UPDATE code path in both pkg/services/ngalert/provisioning/contactpoints.go and pkg/services/ngalert/notifier/receiver_svc.go, but the DELETE path in both receiver services was not updated with the protected-field check, leaving deletion operations unguarded.
2026-08-10 · score 6.5
CVE-2026-72583
A stored cross-site scripting (XSS) vulnerability in fastschema through v0.15.1 allows a low-privileged authenticated user to upload an SVG file containing malicious JavaScript by bypassing the MIME type allow-list check. The pkg/rclonefs/base.go PutMultipart function validates the Content-Type header supplied by the client rather than inspecting the actual file content, enabling an attacker to rename a file to .jpg while specifying image/svg+xml to bypass the filter and store a script-bearing SVG in the web root.
2026-08-10 · score 5.4
CVE-2026-72576
A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. The /admin/ajax/logo-upload endpoint in bl-kernel/ajax/logo-upload.php moves the uploaded file directly to the web root via Filesystem::mv() without invoking sanitizeSVG() or transformImage(), while SVG is present in the ALLOWED_IMG_EXTENSION and ALLOWED_IMG_MIMETYPES allow-lists. A stored script tag in the SVG executes in the browser of any user who loads the logo.
2026-08-10 · score 5.4