Dashboard / CVE-2025-55580

CVE-2025-55580

MEDIUM 1 PoC
MEDIUM Priority: 0.01 BB Relevance: 61/100
Published: 2025-08-29 Modified: 2026-11-07 First seen: 2026-11-07 Status: active

Attack Surface

Network Low Complexity Scope Change

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: Required
S: Changed
C: Low
I: Low
A: None

Description

SolidInvoice version 2.3.7 is vulnerable to a stored cross-site scripting (XSS) issue in the Clients module. An authenticated attacker can inject JavaScript that executes in other users' browsers when the Clients page is viewed. The vulnerability is fixed in version 2.3.8.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
solidinvoice solidinvoice 2.3.7

References & Advisories (2)

https://github.com/ddobrev25/CVE-2025-55580
Exploit Third Party Advisory

Proof of Concept (1)

—
https://github.com/ddobrev25/CVE-2025-55580
nomi-sec

Bug Bounty Relevance

61 / 100
✓ Network accessible
✓ Low complexity
✓ PoC available (1)

CVSS Score

5.4 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS — Exploitation Probability

0.27%
Raw Score 0.002670
Percentile 19.0%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00267
2026-11-12
0.00267
2026-11-10
0.00267
2026-11-09
0.00267
2026-11-08
0.00267
2026-11-07
0.00267

Intelligence Sources

nvd ref →

External Links