Threats affecting pkg:composer/code-projects/invoice-system-in-laravel

A flaw has been found in code-projects Invoice System in Laravel 1.0. Affected is an unknown function of the file /item. Executing a manipulation of the argument item name/description can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used.

A vulnerability was detected in code-projects Invoice System in Laravel 1.0. This impacts an unknown function of the file /item of the component API Endpoint. Performing a manipulation results in improper authorization. It is possible to initiate the attack remotely. The exploit is now public and may be used.

A security vulnerability has been detected in code-projects Invoice System in Laravel 1.0. This affects an unknown function. Such manipulation leads to cross-site request forgery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

A weakness has been identified in code-projects Invoice System in Laravel 1.0. The impacted element is an unknown function of the file /company. This manipulation of the argument logo causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

CVE-2026-7091 is a medium-severity vulnerability in code-projects Invoice System in Laravel version 1.0. It involves improper authorization in an unspecified function within the /user file of the User Management Handler component. This flaw allows remote attackers to exploit the system without proper authorization. Although an exploit has been published, there are no known exploits observed in the wild. No official patch or remediation guidance is currently available from the vendor.