Invoiceshelf vulnerabilities

Products

• Invoiceshelf 12

Newest

• invoiceshelf InvoiceShelf MemberService.php create access control CVE-2026-122158 Public exploit 5.1 MediumNovember 5, 2026
• invoiceshelf InvoiceShelf: Cross-company read/modify/delete of notes via missing company scope in NotePolicy (BOLA/IDOR) CVE-2026-55382 7.6 HighOctober 14, 2026
• invoiceshelf InvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configuration CVE-2026-55385 6.8 MediumOctober 14, 2026
• invoiceshelf InvoiceShelf: IDOR in InvoiceShelf estimate-to-invoice conversion allows any company user to read and tamper with other companies' estimates CVE-2026-55381 7.1 HighOctober 14, 2026
• invoiceshelf InvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosure CVE-2026-55383 8.2 HighOctober 14, 2026
• invoiceshelf InvoiceShelf bulk deletion lacks company scoping CVE-2026-55387 7.2 HighOctober 14, 2026
• invoiceshelf InvoiceShelf ORDER BY SQL injection through orderByField CVE-2026-55386 7.1 HighOctober 14, 2026
• invoiceshelf InvoiceShelf trusts client-supplied document totals CVE-2026-55384 5.3 MediumOctober 14, 2026
• invoiceshelf InvoiceShelf has cross-company user read/update IDOR that enables cross-tenant account takeover CVE-2026-55610 8.7 HighSeptember 23, 2026
• invoiceshelf InvoiceShelf: SSRF in Invoice PDF Rendering via Unsanitised HTML in Notes Field CVE-2026-34367 7.6 HighMarch 31, 2026
• invoiceshelf InvoiceShelf: SSRF in Payment Receipt PDF Rendering via Unsanitised HTML in Notes Field CVE-2026-34366 7.6 HighMarch 31, 2026
• invoiceshelf InvoiceShelf: SSRF in Estimate PDF Rendering via Unsanitised HTML in Notes Field CVE-2026-34365 7.6 HighMarch 31, 2026