CVE-2025-66370
Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD format, it is possible to read and exfiltrate files fro...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD format, it is possible to read and exfiltrate files from the server's filesystem.
Références
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- patch github.com
- web github.com
- web invoice.secvuln.info
- web blog.kivitendo.de