InvoiceNinja v5‑stable renders an invoice or quote’s “terms” field within the client portal using Laravel Blade’s raw output directive without any HTML sanitization. This allows an attacker to inject arbitrary HTML or JavaScript into the terms field, which is stored and subsequently rendered whenever a client views the invoice or quote. Based on the description, it is inferred that the injected script can steal the client’s session cookies and potentially take over the client account. This compromise targets the confidentiality of client credentials and the integrity of account permissions, enabling the attacker to execute arbitrary actions within the portal.

Based on the description, it is inferred that the affected product is InvoiceNinja, specifically the v5‑stable release that contains the unfiltered terms rendering logic. Any installation that allows users to create or modify invoices and supply a value for the terms field, whether via the web interface or an API, is vulnerable. The vulnerability is independent of the previously disclosed invoice line‑item description XSS flaw.

The CVSS score of 8.7 indicates a high‑severity vulnerability with wide impact. The EPSS score of 0.00199 demonstrates a low but non‑zero probability of exploitation, roughly 0.2%. The lack of a KEV listing means no confirmed exploit has been documented publicly yet. Based on the described functionality, it is inferred that the attack path only requires an authenticated user with invoice‑creation permissions, so insider or compromised accounts can trivially exploit it. The script executes in the victim’s browser when the invoice is viewed, making it a straightforward client‑side attack that requires no additional network connectivity once the malicious payload is stored.