CVE-2025-55580
Last modified
CVE-2025-55580 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. SolidInvoice version 2.3.7 is vulnerable to a stored cross-site scripting (XSS) issue in the Clients module. An authenticated attacker can inject JavaScript that executes in other users' browsers when the Clients page is viewed. EPSS estimates a 0.24% chance of exploitation in the next 30 days.
Description
SolidInvoice version 2.3.7 is vulnerable to a stored cross-site scripting (XSS) issue in the Clients module. An authenticated attacker can inject JavaScript that executes in other users' browsers when the Clients page is viewed. The vulnerability is fixed in version 2.3.8.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Solidinvoice | Solidinvoice | 2.3.7 |
References
- https://github.com/ddobrev25/CVE-2025-55580Exploit, Third Party Advisory
- https://solidinvoice.co/Product
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-55580?
How severe is CVE-2025-55580?
How do I fix CVE-2025-55580?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-5557A vulnerability has been found in PHPGurukul Teacher Subject…8.8
- CVE-2025-55573QuantumNous new-api v.0.8.5.2 is vulnerable to Cross Site Sc…8.8
- CVE-2025-55574Cross Site Scripting vulnerability in docmost v.0.21.0 and b…6.1
- CVE-2025-55575SQL Injection vulnerability in SMM Panel 3.1 allowing remote…9.8
- CVE-2025-55579SolidInvoice version 2.3.7 is vulnerable to a Stored Cross-S…5.4
- CVE-2025-5558A vulnerability was found in PHPGurukul Teacher Subject Allo…8.8
- CVE-2025-55581D-Link DCS-825L firmware version 1.08.01 and possibly prior …7.3
- CVE-2025-55582D-Link DCS-825L firmware v1.08.01 contains a vulnerability i…6.6
- CVE-2025-55583D-Link DIR-868L B1 router firmware version FW2.05WWB02 conta…9.8
- CVE-2025-55584TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to cont…5.3
- CVE-2025-55585TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to cont…6.5
- CVE-2025-55586TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to cont…7.5
Are you affected by CVE-2025-55580?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST