CVE-2026-110592

LOW 3.5

BottleCRM 0.30 through 1.14.5 HTML Injection via Custom Invoice PDF Template

CVSS Score

3.5

EPSS Score

0.0%

EPSS Percentile

0th

BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in render_invoice_template() that allows authenticated organization members to inject markup into custom-template invoice PDFs. Attackers can place HTML and CSS in notes, terms, client name or address fields to overlay totals, payee and payment instructions in PDFs served via download, public links and emails.

CWE	CWE-116
Vendor	micropyramid
Product	bottlecrm
Published	Oct 14, 2026
Last Updated	Oct 14, 2026

Stay Ahead of the Next One

Get instant alerts for micropyramid bottlecrm

Be the first to know when new low vulnerabilities affecting micropyramid bottlecrm are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Affected Versions

MicroPyramid / BottleCRM

0.30 ≤ 1.14.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Django-CRM/Django-CRM/issues/825 github.com: https://github.com/Django-CRM/Django-CRM/blob/v1.14.5/backend/invoices/pdf.py#L660-L712 vulncheck.com: https://www.vulncheck.com/advisories/bottlecrm-0.30-through-1.14.5-html-injection-via-custom-invoice-pdf-template

Credits

Aaron Amran Bin Amiruddin (@aaronamran)