Solidinvoice vulnerabilities

Products

• Solidinvoice 13

Newest

• solidinvoice SolidInvoice allows cross-user access to API token request history via writable DataGrid LiveComponent props CVE-2026-61688 6.5 MediumSeptember 4, 2026
• solidinvoice SolidInvoice's long-lived API tokens accepted as URL query parameters, exposing credentials in server logs and browser history CVE-2026-61614 5.9 MediumSeptember 4, 2026
• solidinvoice SolidInvoice's user invitation tokens have no expiry, allowing indefinite unauthorized company access via leaked or old invitation links CVE-2026-61608 6.8 MediumSeptember 4, 2026
• solidinvoice SolidInvoice: PHP unserialize() called on client-controlled data in DataGrid LiveComponent context prop CVE-2026-61686 7.5 HighSeptember 4, 2026
• solidinvoice SolidInvoice: Unrestricted file upload with no MIME validation allows stored XSS via malicious SVG logo CVE-2026-46489 8.1 HighJune 11, 2026
• solidinvoice SolidInvoice: API tokens stored as plaintext in the database allowing full credential compromise on database breach CVE-2026-46622 8.1 HighJune 11, 2026
• solidinvoice SolidInvoice 2.3.7 and v.2.3.8 is vulnerable to Cross Site Scripting (XSS) in the client's... CVE-2025-55580 Public exploit 5.4 MediumAugust 29, 2025
• solidinvoice SolidInvoice 2.3.7 and fixed in v.2.3.8 is vulnerable to Cross Site Scripting (XSS) in the Tax... CVE-2025-55579 Public exploit 5.4 MediumAugust 29, 2025
• solidinvoice SolidInvoice Clients clients cross site scripting CVE-2025-9171 5.1 MediumAugust 19, 2025
• solidinvoice SolidInvoice Tax Rates rates cross site scripting CVE-2025-9170 5.1 MediumAugust 19, 2025
• solidinvoice SolidInvoice Quote quotes cross site scripting CVE-2025-9169 5.1 MediumAugust 19, 2025
• solidinvoice SolidInvoice Invoice Creation invoice cross site scripting CVE-2025-9168 5.1 MediumAugust 19, 2025
• solidinvoice SolidInvoice Recurring Invoice recurring cross site scripting CVE-2025-9167 5.1 MediumAugust 19, 2025