CVE-2026-14791

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-14791
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14791.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-14791
Published
2026-07-06T02:30:11.384Z
Modified
2026-07-15T01:48:53.066538395Z
Severity
  • 2.0 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
crater-invoice-inc crater Invoice Note InvoicesRequest.php getFormattedString cross site scripting
Details

A weakness has been identified in crater-invoice-inc crater up to 6.0.6. This affects the function getFormattedString of the file app/Http/Requests/InvoicesRequest.php of the component Invoice Note Handler. Executing a manipulation of the argument notes can lead to cross site scripting. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Database specific 
{
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14791.json",
    "cwe_ids": [
        "CWE-79",
        "CWE-94"
    ]
}
References

Affected packages

Git / github.com/crater-invoice-inc/crater

Affected ranges

Type
GIT
Repo
https://github.com/crater-invoice-inc/crater
Events
Introduced
dcb3ddecb9f4cde622cc42c51a2760747797624f
Last affected
18507ddb6f5881530ac78ba37b3d0b86c2e7e83f
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "6.0.0"
        },
        {
            "last_affected": "6.0.0"
        },
        {
            "introduced": "6.0.1"
        },
        {
            "last_affected": "6.0.1"
        },
        {
            "introduced": "6.0.2"
        },
        {
            "last_affected": "6.0.2"
        },
        {
            "introduced": "6.0.3"
        },
        {
            "last_affected": "6.0.3"
        },
        {
            "introduced": "6.0.4"
        },
        {
            "last_affected": "6.0.4"
        },
        {
            "introduced": "6.0.5"
        },
        {
            "last_affected": "6.0.5"
        },
        {
            "introduced": "6.0.6"
        },
        {
            "last_affected": "6.0.6"
        }
    ]
}

Affected versions

6.*
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14791.json"