Skip to content
Invoiceplane vulnerabilities
Newest
-
invoiceplane
InvoicePlane: Guest user IDOR in quote approval and rejection
CVE-2026-55561
5.3 Medium
-
invoiceplane
InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)
CVE-2026-100392
7.0 High
-
invoiceplane
InvoicePlane: Incomplete Authorization Remediation in Users::form() Enables Primary Administrator Account Takeover via Email Reassignment and Password Recovery
CVE-2026-100371
8.7 High
-
invoiceplane
InvoicePlane: Failure to Revoke Administrative Privileges After Role Downgrade
CVE-2026-88003
7.5 High
-
invoiceplane
InvoicePlane: Missing CSRF Protection on State-Changing delete Actions
CVE-2026-49850
7.5 High
-
invoiceplane
InvoicePlane permits local file inclusion through the e-invoice XML configuration identifier
CVE-2026-50547
7.5 High
-
invoiceplane
InvoicePlane permits DDL injection through tax_rate_decimal_places
CVE-2026-33639
7.2 High
-
invoiceplane
InvoicePlane: Remote Code Execution via Writable Templates Directory
CVE-2026-39353
9.1 Critical
-
invoiceplane
InvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer Forms
CVE-2026-85293
4.8 Medium
-
invoiceplane
InvoicePlane IDOR: Horizontal Privilege Escalation via Password Change Without Authorization Check
CVE-2026-85291
6.5 Medium
-
invoiceplane
InvoicePlane: Missing CSRF Token Validation on Multiple Delete Endpoints
CVE-2026-85289
6.5 Medium
-
invoiceplane
InvoicePlane: Loose Type Comparison in Core Authentication Check (Defense-in-Depth)
CVE-2026-85292
4.8 Medium
-
invoiceplane
InvoicePlane: Recurring Invoice State Change via GET Request Without CSRF Protection
CVE-2026-85274
6.5 Medium
-
invoiceplane
InvoicePlane: Log Injection via Unsanitized User Input in Cron Key Error Logging
CVE-2026-85290
5.3 Medium
-
invoiceplane
InvoicePlane: Sensitive Information Disclosure via Unstripped EXIF Metadata in Attachments
CVE-2026-39372
4.9 Medium
-
invoiceplane
InvoicePlane: Second-order SQL injection through the unvalidated custom_field_table field in the Custom Fields module
CVE-2026-54790
6.0 Medium
-
invoiceplane
InvoicePlane has Stored Cross-Site Scripting (XSS) Issue in Sumex Invoice View
CVE-2026-26281
4.4 Medium
-
invoiceplane
InvoicePlane has Stored Cross-Site Scripting Issue in Identifier Formatting
CVE-2026-26270
5.4 Medium
-
invoiceplane
InvoicePlane has Stored XSS via Product Unit Name in Invoice Item List
CVE-2026-25596
Public exploit
4.8 Medium
-
invoiceplane
InvoicePlane has Stored XSS via Invoice Number in Invoice View and Dashboard
CVE-2026-25595
Public exploit
4.8 Medium
-
invoiceplane
InvoicePlane has Stored XSS via Family Name in Product Form
CVE-2026-25594
Public exploit
4.8 Medium
-
invoiceplane
InvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoning
CVE-2026-25548
Public exploit
9.1 Critical
-
invoiceplane
InvoicePlane has a Stored Cross-Site Scripting (XSS) issue
CVE-2026-24745
5.7 Medium
-
invoiceplane
InvoicePlane has a Stored Cross-Site Scripting (XSS) issue
CVE-2026-24744
5.7 Medium
-
invoiceplane
InvoicePlane has a Stored Cross-Site Scripting (XSS) issue
CVE-2026-24743
5.7 Medium
-
invoiceplane
InvoicePlane has a Stored Cross-Site Scripting (XSS) issue
CVE-2026-24746
5.7 Medium
-
invoiceplane
InvoicePlane has Unauthenticated Path Traversal in Guest Controller
CVE-2026-23491
Public exploit
9.3 Critical
-
invoiceplane
File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload...
CVE-2025-67084
9.9 Critical
-
invoiceplane
Directory traversal vulnerability in InvoicePlane through 1.6.3 allows unauthenticated attackers...
CVE-2025-67083
5.3 Medium
-
invoiceplane
An SQL injection vulnerability in InvoicePlane through 1.6.3 has been identified in "maxQuantity"...
CVE-2025-67082
6.5 Medium
-
invoiceplane
InvoicePlane commit debb446c is vulnerable to Incorrect Access Control. The invoices/view handler...
CVE-2025-64012
4.3 Medium
-
invoiceplane
InvoicePlane (all versions tested as of December 2024) v.1.6.11 and before contains a remote code...
CVE-2024-56975
9.8 Critical
-
invoiceplane
InvoicePlane view session expiration
CVE-2024-12667
6.3 Medium
-
invoiceplane
InvoicePlane 1 upload_file unrestricted upload
CVE-2024-12478
5.3 Medium
-
invoiceplane
InvoicePlane invoices.php download path traversal
CVE-2024-12362
5.3 Medium
-
invoiceplane
Cross Site Scripting (XSS) vulnerability in InvoicePlane 1.6 via filter_product input to file...
CVE-2023-23011
6.1 Medium
-
invoiceplane
In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and...
CVE-2021-29024
7.5 High
-
invoiceplane
InvoicePlane 1.5.11 doesn't have any rate-limiting for password reset and the reset token is...
CVE-2021-29023
5.3 Medium
-
invoiceplane
In InvoicePlane 1.5.11, the upload feature discloses the full path of the file upload directory.
CVE-2021-29022
5.3 Medium
-
invoiceplane
InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoice_password parameter,...
CVE-2019-7223
5.4 Medium
-
invoiceplane
An XSS issue was discovered in InvoicePlane 1.5.10 via the "Quote PDF Password(Optional)" field.
CVE-2018-12255
6.1 Medium
-
invoiceplane
An issue was discovered in InvoicePlane before 1.5.5. It was observed that the Email address and...
CVE-2017-18217
6.1 Medium
-
invoiceplane
Invoice Plane version 1.5.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in...
CVE-2017-1000508
6.1 Medium
-
invoiceplane
InvoicePlane version 1.4.10 is vulnerable to a Stored Cross Site Scripting resulting in allowing...
CVE-2017-1000239
5.4 Medium
-
invoiceplane
InvoicePlane version 1.4.10 is vulnerable to a Arbitrary File Upload resulting in an...
CVE-2017-1000238
8.8 High