CVE-2025-55580 in SolidInvoice
Summary
by MITRE • 08/29/2025
A security flaw has been discovered in SolidInvoice up to 2.4.0. The impacted element is an unknown function of the file /clients of the component Clients Module. Performing manipulation of the argument Name results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/18/2026
This vulnerability resides within the SolidInvoice clients module where an unknown function processes input parameters from the /clients endpoint. The flaw manifests as a cross site scripting vulnerability that occurs when the Name argument is manipulated during client data processing. The vulnerability affects versions up to 2.4.0 and represents a critical security risk that allows remote exploitation without requiring authentication or special privileges. The attack vector operates entirely through web-based interactions, making it particularly dangerous as it can be exploited by attackers who simply need access to the target system's network.
The technical implementation of this vulnerability stems from inadequate input validation and output sanitization within the client management functionality. When user-supplied data enters the system through the Name parameter, the application fails to properly escape or filter special characters that could be interpreted as executable script code by web browsers. This represents a classic cross site scripting flaw that aligns with CWE-79, which specifically addresses improper neutralization of input during web page generation in web applications. The vulnerability permits attackers to inject malicious scripts that execute in the context of other users' browsers, potentially leading to session hijacking, data theft, or further system compromise.
The operational impact of this vulnerability extends beyond simple script injection as it provides attackers with the capability to perform persistent attacks against users of the SolidInvoice system. Remote exploitation means that malicious actors can target vulnerable installations from anywhere on the internet without requiring physical access or network proximity. The fact that a public exploit exists significantly increases the risk profile as it eliminates the need for advanced technical skills to carry out attacks. This vulnerability affects the core client management functionality of the application, potentially allowing attackers to access sensitive client information, modify client records, or redirect users to malicious websites.
Security professionals should immediately assess their SolidInvoice installations for this vulnerability and implement appropriate mitigations. The most effective immediate response involves implementing proper input validation and output encoding for all user-supplied data, particularly within the client management module. Organizations should consider implementing content security policies to prevent unauthorized script execution and deploy web application firewalls to detect and block malicious requests. The lack of vendor response to early disclosure attempts creates additional risk as there may be no official patches or updates available through normal channels. This vulnerability demonstrates the importance of maintaining current security awareness and having contingency plans for situations where vendors fail to respond to security concerns. Organizations should also consider monitoring for exploitation attempts and implementing network-based detection measures to identify potential attacks against this specific vulnerability. The presence of a public exploit increases the urgency of remediation efforts as attackers are actively targeting vulnerable systems.