Invoice Ninja versions 5.12.46 and 5.12.48 contain a server‑side request forgery vulnerability in CheckDatabaseRequest.php. The flaw allows an attacker to instruct the application’s server to initiate HTTP requests to arbitrary URLs. This can enable disclosure of internal resources, exfiltration of sensitive data, or further exploitation of the internal network. The impact is that an attacker can gain unauthorized network access beyond the intended scope of the application.

Any installation of Invoice Ninja running version 5.12.46 or 5.12.48 is affected. The vulnerability is present in the web application irrespective of the underlying operating system or infrastructure. No other versions are listed as impacted.

The publicly available information does not provide a CVSS score or EPSS data, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, relying on the web endpoint that processes the CheckDatabaseRequest. Because the flaw exists in a publicly exposed PHP file, exploitation is likely straightforward for attackers with access to the web interface or the ability to supply requests to the affected endpoint. Until a patch is applied, the risk remains significant.