CVE-2026-7092
code-projects Invoice System in Laravel Profile profile improper authorization
- State
- Published
- Severity
- 5.3 Medium
- Published
- Apr 27, 2026
- Updated
- Apr 29, 2026
- Reserved
- Apr 26, 2026
Description
A vulnerability has been found in code-projects Invoice System in Laravel 1.0. Affected is an unknown function of the file /profile/ of the component Profile Handler. Such manipulation of the argument ID leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Invoice System in Laravelcode-projects |
|
References
- VDB-359667 | code-projects Invoice System in Laravel Profile profile improper authorizationvdb-entrytechnical-description
- VDB-359667 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #800388 | code-projects Invoice System in Laravel 1.0 Insecure Direct Object Reference (IDOR)third-party-advisory
- https://gist.github.com/higordiego/9b5f076d7f651e45c0f30ae14bab3b4eexploit
- https://code-projects.org/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.