CVE-2025-55580

{
  "id": "CVE-2025-55580",
  "sourceIdentifier": "[email protected]",
  "published": "2025-08-29T17:15:35.480",
  "lastModified": "2026-11-07T18:10:00.200",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SolidInvoice version 2.3.7 is vulnerable to a stored cross-site scripting (XSS) issue in the Clients module. An authenticated attacker can inject JavaScript that executes in other users' browsers when the Clients page is viewed. The vulnerability is fixed in version 2.3.8."
    },
    {
      "lang": "es",
      "value": "SolidInvoice versión 2.3.7 es vulnerable a un problema de cross-site scripting (XSS) almacenado en el módulo de Clientes. Un atacante autenticado puede inyectar JavaScript que se ejecuta en los navegadores de otros usuarios cuando se visualiza la página de Clientes. La vulnerabilidad está corregida en la versión 2.3.8."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-08-29T17:03:48.756031Z",
          "id": "CVE-2025-55580",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:solidinvoice:solidinvoice:2.3.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "3812F52B-1CAD-4793-9C02-5A2D64F1CF8F"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/ddobrev25/CVE-2025-55580",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://solidinvoice.co/",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    }
  ]
}