CVE-2025-55580

5.4 mediumEPSS 0.3%

Medium (5.4) in solidinvoice solidinvoice. EPSS 0.3% chance of exploitation in the next 30 days.

SolidInvoice version 2.3.7 is vulnerable to a stored cross-site scripting (XSS) issue in the Clients module. An authenticated attacker can inject JavaScript that executes in other users' browsers when the Clients page is viewed. The vulnerability is fixed in version 2.3.8.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 18% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2025-08-29
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

solidinvoice:solidinvoice

References

https://github.com/ddobrev25/CVE-2025-55580
https://solidinvoice.co/

Check your stack JSON