CVE-2026-7108

MEDIUM

code-projects Invoice System in Laravel cross-site request forgery

Title source: cna

Description

A security vulnerability has been detected in code-projects Invoice System in Laravel 1.0. This affects an unknown function. Such manipulation leads to cross-site request forgery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

References (5)

Core 5

Core References

Vdb Entry vdb-entry

VDB-359709 | code-projects Invoice System in Laravel cross-site request forgery

https://vuldb.com/vuln/359709

Signature, Permissions Required signature permissions-required

VDB-359709 | CTI Indicators (IOB, IOC)

https://vuldb.com/vuln/359709/cti

Exploit exploit

https://gist.github.com/higordiego/e25a1bb5cf93ffbda2e80b6cbc031a8b

Third Party Advisory third-party-advisory

Submit #800691 | code-projects Invoice System in Laravel 1.0 Cross-Site Request Forgery (CSRF) + Weak Session Handling

https://vuldb.com/submit/800691

Product product

https://code-projects.org/

Scores

CVSS v3 4.3

EPSS 0.0015

EPSS Percentile 4.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-352 CWE-862

Status published

Products (1)

code-projects/Invoice System in Laravel 1.0

Published Apr 27, 2026

Tracked Since Apr 27, 2026