{"action":"Upgrade invoiceninja/invoiceninja to 5.13.4 or later.","affected":[{"fixed":"5.13.4","introduced":"0"}],"component":"invoiceninja/invoiceninja","cve_ids":["CVE-2026-33628"],"ecosystem":"Packagist","epss":0.0024,"exploited":false,"fixed_versions":["5.13.4"],"ghsa_id":"GHSA-98wm-cxpw-847p","id":"tcs_01M5KEZVRP256TE3CR04X6H6AX","modified_at":"2026-03-27T21:50:43.613847Z","published_at":"2026-03-24T20:40:16Z","references":["https://osv.dev/vulnerability/GHSA-98wm-cxpw-847p","https://github.com/invoiceninja/invoiceninja/security/advisories/GHSA-98wm-cxpw-847p","https://nvd.nist.gov/vuln/detail/CVE-2026-33628","https://github.com/invoiceninja/invoiceninja/commit/b81a3fc302573fc4a53d61e8537dd19154ce1091","https://github.com/invoiceninja/invoiceninja","https://github.com/invoiceninja/invoiceninja/releases/tag/v5.13.4"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-98wm-cxpw-847p","url":"https://osv.dev/vulnerability/GHSA-98wm-cxpw-847p"}],"summary":"Invoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line Items"}