CVE-2025-9170

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability was identified in SolidInvoice up to 2.4.0. The affected element is an unknown function of the file /tax/rates of the component Tax Rates Module. Such manipulation of the argument Name leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
n/a	SolidInvoice	2.0; 2.1; 2.2; 2.3; 2.4.0

References

https://github.com/Gabrielmouraofc/PoC_Vuldb/blob/main/%F0%9F%93%84PoC%20-Stored%20XSS%204.mdExploit, Third Party Advisory
https://github.com/Gabrielmouraofc/PoC_Vuldb/blob/main/%F0%9F%93%84PoC%20-Stored%20XSS%204.md#-exploitation-stepsExploit, Third Party Advisory
https://vuldb.com/?ctiid.320547Permissions Required
https://vuldb.com/?id.320547Third Party Advisory, VDB Entry
https://vuldb.com/?submit.630627Third Party Advisory, VDB Entry
https://github.com/Gabrielmouraofc/PoC_Vuldb/blob/main/%F0%9F%93%84PoC%20-Stored%20XSS%204.mdExploit, Third Party Advisory
https://github.com/Gabrielmouraofc/PoC_Vuldb/blob/main/%F0%9F%93%84PoC%20-Stored%20XSS%204.md#-exploitation-stepsExploit, Third Party Advisory
https://vuldb.com/?submit.630627Third Party Advisory, VDB Entry

Timeline

Published: Aug 19, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-91715.4A security flaw has been discovered in SolidInvoice up to 2.4.0. The impacted element is an unknown function of the file /clients of the com CVE-2025-91727.5The Vibes plugin for WordPress is vulnerable to time-based SQL Injection via the ‘resource’ parameter in all versions up to, and including, CVE-2025-91747.8A vulnerability was determined in neurobin shc up to 4.0.3. This vulnerability affects the function make of the file src/shc.c of the compon CVE-2025-91757.8A vulnerability was identified in neurobin shc up to 4.0.3. This issue affects the function make of the file src/shc.c. The manipulation lea CVE-2025-91767.8A security flaw has been discovered in neurobin shc up to 4.0.3. Impacted is the function make of the file src/shc.c of the component Enviro CVE-2025-91777.7A denial-of-service security issue exists in the affected product and version. The security issue stems from a high number of requests sent CVE-2025-91787.7A denial-of-service security issue exists in the affected product and version. The security issue is caused through CIP communication using CVE-2025-91799.8An attacker was able to perform memory corruption in the GMP process which processes encrypted media. This process is also heavily sandboxed CVE-2025-91808.1Same-origin policy bypass in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 142, Firefox ESR 115.27, Firefox ESR CVE-2025-91816.5Uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 142, Firefox ESR 128.14, Firefox ESR 140.2,CVE-2025-91827.5Denial-of-service due to out-of-memory in the Graphics: WebRender component. This vulnerability was fixed in Firefox 142, Firefox ESR 140.2,CVE-2025-91836.5Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 142 and Firefox ESR 140.2.