InvoicePlane

Records45All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical5CVSS 9.0–10.0

CVSS high12CVSS 7.0–8.9

Exploited now

InvoicePlane records in CISA KEV

No InvoicePlane vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Invoiceplane 29 records HIGH

Records

45 records

TI-2026-18924 CVE-2026-23491

InvoicePlane has Unauthenticated Path Traversal in Guest Controller

HIGH 81

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.04605 Published 2026-02-18 Fixed in 1.6.4 CWE-22

TI-2026-64649 CVE-2026-100371

Incorrect authorization in InvoicePlane

HIGH 77

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00351 Published 2026-09-28 No fix listed CWE-863

TI-2025-41126 CVE-2025-67084 · GHSA-jpvh-v7h3-v24c

File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to…

HIGH 76

File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Execution (RCE).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00444 Published 2026-01-15 No fix listed CWE-616

TI-2026-28341 CVE-2026-39353

InvoicePlane: Remote Code Execution via Writable Templates Directory

HIGH 74

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00448 Published 2026-09-25 Fixed in 1.7.2-rc-1 CWE-693

TI-2026-60029 CVE-2026-88003

InvoicePlane: Failure to Revoke Administrative Privileges After Role Downgrade

HIGH 68

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 4.0HIGH 7.5 Network High privileges No interaction EPSS 0.00378 Published 2026-09-25 Fixed in 1.7.2 CWE-863

TI-2026-26020 CVE-2026-33639

InvoicePlane permits DDL injection through tax_rate_decimal_places

HIGH 67

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00507 Published 2026-09-25 Fixed in 1.7.2 CWE-89

TI-2026-19951 CVE-2026-24746

InvoicePlane has a Stored Cross-Site Scripting (XSS) issue

HIGH 66

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1HIGH 7.5 Network High privileges User interaction EPSS 0.00323 Published 2026-02-18 No fix listed CWE-79

TI-2026-19950 CVE-2026-24745

InvoicePlane has a Stored Cross-Site Scripting (XSS) issue

HIGH 66

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1HIGH 7.5 Network High privileges User interaction EPSS 0.00262 Published 2026-02-18 No fix listed CWE-79

TI-2026-19949 CVE-2026-24744

InvoicePlane has a Stored Cross-Site Scripting (XSS) issue

HIGH 66

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1HIGH 7.5 Network High privileges User interaction EPSS 0.00262 Published 2026-02-18 No fix listed CWE-79

TI-2026-19948 CVE-2026-24743

InvoicePlane has a Stored Cross-Site Scripting (XSS) issue

HIGH 66

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1HIGH 7.5 Network High privileges User interaction EPSS 0.00262 Published 2026-02-18 No fix listed CWE-79

TI-2026-64665 CVE-2026-100392

InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)

MEDIUM 64

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 4.0HIGH 7.0 Network High privileges No interaction EPSS 0.00285 Published 2026-09-28 No fix listed CWE-863

TI-2026-58570 CVE-2026-85291

InvoicePlane IDOR: Horizontal Privilege Escalation via Password Change Without Authorization Check

MEDIUM 64

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00324 Published 2026-09-25 Fixed in 1.7.2 CWE-639

TI-2026-58569 CVE-2026-85290

InvoicePlane: Log Injection via Unsanitized User Input in Cron Key Error Logging

MEDIUM 63

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00291 Published 2026-09-25 Fixed in 1.7.2 CWE-117

TI-2025-41125 CVE-2025-67083 · GHSA-r995-4vfx-ppgf

Directory traversal vulnerability in InvoicePlane through 1.6.3 allows unauthenticated…

MEDIUM 63

Directory traversal vulnerability in InvoicePlane through 1.6.3 allows unauthenticated attackers to read files from the server.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00722 Published 2026-01-15 No fix listed CWE-22

TI-2026-58568 CVE-2026-85289

InvoicePlane: Missing CSRF Token Validation on Multiple Delete Endpoints

MEDIUM 62

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00168 Published 2026-09-25 Fixed in 1.7.2 CWE-352

TI-2026-58565 CVE-2026-85274

InvoicePlane: Recurring Invoice State Change via GET Request Without CSRF Protection

MEDIUM 62

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00168 Published 2026-09-25 Fixed in 1.7.2 CWE-352

TI-2025-41124 CVE-2025-67082 · GHSA-mfr5-898v-5wmr

An SQL injection vulnerability in InvoicePlane through 1.6.3 has been identified in…

MEDIUM 62

An SQL injection vulnerability in InvoicePlane through 1.6.3 has been identified in "maxQuantity" and "minQuantity" parameters when generating a report.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00321 Published 2026-01-15 No fix listed CWE-89

TI-2026-39596 CVE-2026-54790

InvoicePlane: Second-order SQL injection through the unvalidated custom_field_table field in the Custom Fields module

MEDIUM 60

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1MEDIUM 6.0 Network High privileges No interaction EPSS 0.00283 Published 2026-09-25 Fixed in 1.7.2 CWE-89

TI-2026-21240 CVE-2026-26270

InvoicePlane has Stored Cross-Site Scripting Issue in Identifier Formatting

MEDIUM 58

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00204 Published 2026-02-18 No fix listed CWE-79

TI-2026-82247 CVE-2026-55561

Guest user IDOR in InvoicePlane quote approval and rejection

MEDIUM 57

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00275 Published 2026-10-28 Fixed in 1.7.2-beta-1 CWE-639

TI-2026-28359 CVE-2026-39372

InvoicePlane: Sensitive Information Disclosure via Unstripped EXIF Metadata in Attachments

MEDIUM 56

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00353 Published 2026-09-25 Fixed in 1.7.2 CWE-200

TI-2026-58572 CVE-2026-85293

InvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer Forms

MEDIUM 55

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00225 Published 2026-09-25 Fixed in 1.7.2 CWE-79

TI-2026-20703 CVE-2026-25596

InvoicePlane has Stored XSS via Product Unit Name in Invoice Item List

MEDIUM 55

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00242 Published 2026-02-18 No fix listed CWE-79

TI-2026-21250 CVE-2026-26281

InvoicePlane has Stored Cross-Site Scripting (XSS) Issue in Sumex Invoice View

MEDIUM 54

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1MEDIUM 4.4 Network Low privileges User interaction EPSS 0.00212 Published 2026-02-18 No fix listed CWE-79

TI-2025-39509 CVE-2025-64012 · GHSA-6h7w-vjm9-6785

InvoicePlane commit debb446c is vulnerable to Incorrect Access Control.

MEDIUM 53

InvoicePlane commit debb446c is vulnerable to Incorrect Access Control.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00301 Published 2025-12-16 No fix listed CWE-639

Open these records in search →