InvoicePlane

Records45All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical5CVSS 9.0–10.0

CVSS high12CVSS 7.0–8.9

Exploited now

InvoicePlane records in CISA KEV

No InvoicePlane vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Invoiceplane 29 records HIGH

Records

29 records in Invoiceplane · all components

TI-2026-18924 CVE-2026-23491

InvoicePlane has Unauthenticated Path Traversal in Guest Controller

HIGH 81

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.04605 Published 2026-02-18 Fixed in 1.6.4 CWE-22

TI-2025-41126 CVE-2025-67084 · GHSA-jpvh-v7h3-v24c

File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to…

HIGH 76

File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Execution (RCE).

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00444 Published 2026-01-15 No fix listed CWE-616

TI-2026-19951 CVE-2026-24746

InvoicePlane has a Stored Cross-Site Scripting (XSS) issue

HIGH 66

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1HIGH 7.5 Network High privileges User interaction EPSS 0.00323 Published 2026-02-18 No fix listed CWE-79

TI-2026-19950 CVE-2026-24745

InvoicePlane has a Stored Cross-Site Scripting (XSS) issue

HIGH 66

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1HIGH 7.5 Network High privileges User interaction EPSS 0.00262 Published 2026-02-18 No fix listed CWE-79

TI-2026-19949 CVE-2026-24744

InvoicePlane has a Stored Cross-Site Scripting (XSS) issue

HIGH 66

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1HIGH 7.5 Network High privileges User interaction EPSS 0.00262 Published 2026-02-18 No fix listed CWE-79

TI-2026-19948 CVE-2026-24743

InvoicePlane has a Stored Cross-Site Scripting (XSS) issue

HIGH 66

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1HIGH 7.5 Network High privileges User interaction EPSS 0.00262 Published 2026-02-18 No fix listed CWE-79

TI-2025-41125 CVE-2025-67083 · GHSA-r995-4vfx-ppgf

Directory traversal vulnerability in InvoicePlane through 1.6.3 allows unauthenticated…

MEDIUM 63

Directory traversal vulnerability in InvoicePlane through 1.6.3 allows unauthenticated attackers to read files from the server.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00722 Published 2026-01-15 No fix listed CWE-22

TI-2025-41124 CVE-2025-67082 · GHSA-mfr5-898v-5wmr

An SQL injection vulnerability in InvoicePlane through 1.6.3 has been identified in…

MEDIUM 62

An SQL injection vulnerability in InvoicePlane through 1.6.3 has been identified in "maxQuantity" and "minQuantity" parameters when generating a report.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00321 Published 2026-01-15 No fix listed CWE-89

TI-2026-21240 CVE-2026-26270

InvoicePlane has Stored Cross-Site Scripting Issue in Identifier Formatting

MEDIUM 58

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00204 Published 2026-02-18 No fix listed CWE-79

TI-2026-20703 CVE-2026-25596

InvoicePlane has Stored XSS via Product Unit Name in Invoice Item List

MEDIUM 55

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00242 Published 2026-02-18 No fix listed CWE-79

TI-2026-21250 CVE-2026-26281

InvoicePlane has Stored Cross-Site Scripting (XSS) Issue in Sumex Invoice View

MEDIUM 54

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1MEDIUM 4.4 Network Low privileges User interaction EPSS 0.00212 Published 2026-02-18 No fix listed CWE-79

TI-2025-39509 CVE-2025-64012 · GHSA-6h7w-vjm9-6785

InvoicePlane commit debb446c is vulnerable to Incorrect Access Control.

MEDIUM 53

InvoicePlane commit debb446c is vulnerable to Incorrect Access Control.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00301 Published 2025-12-16 No fix listed CWE-639

TI-2024-37736 CVE-2024-56975 · GHSA-2fqc-9m76-ppwc

InvoicePlane (all versions tested as of December 2024) v.1.6.11 and before contains a…

MEDIUM 50

InvoicePlane (all versions tested as of December 2024) v.1.6.11 and before contains a remote code execution vulnerability in the upload_file method of the Upload controller.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0069 Published 2025-03-28 No fix listed CWE-434

TI-2026-20657 CVE-2026-25548

InvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoning

MEDIUM 43

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.0086 Published 2026-02-18 No fix listed CWE-117

TI-2017-14553 CVE-2017-1000238 · GHSA-9423-2j6f-86j6

InvoicePlane version 1.4.10 is vulnerable to a Arbitrary File Upload resulting in an…

MEDIUM 40

InvoicePlane version 1.4.10 is vulnerable to a Arbitrary File Upload resulting in an authenticated user can upload a malicious file to the webserver.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.0107 Published 2017-11-17 No fix listed CWE-434

TI-2021-09919 CVE-2021-29024 · GHSA-q48v-hqmw-c65v

In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory…

LOW 36

In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and file download.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01642 Published 2021-05-17 No fix listed CWE-552

TI-2017-13402 CVE-2017-18217 · GHSA-vhw5-93mq-qwww

An issue was discovered in InvoicePlane before 1.5.5.

LOW 30

An issue was discovered in InvoicePlane before 1.5.5.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01282 Published 2018-03-05 No fix listed CWE-79

TI-2024-11752 CVE-2024-12667 · GHSA-xxvf-6jpw-pp5x

InvoicePlane view session expiration

LOW 29

A vulnerability was found in InvoicePlane up to 1.6.1 and classified as problematic.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00528 Published 2024-12-16 No fix listed CWE-613

TI-2017-14716 CVE-2017-1000508 · GHSA-p6q4-h4rq-q2x3

Invoice Plane version 1.5.4 and earlier contains a Cross Site Scripting (XSS)…

LOW 29

Invoice Plane version 1.5.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in Client's details that can result in execution of javascript code .

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01039 Published 2018-02-09 No fix listed CWE-79

TI-2023-09116 CVE-2023-23011 · GHSA-f79p-fhg6-6wgx

Cross Site Scripting (XSS) vulnerability in InvoicePlane 1.6 via filter_product input to file modal_product_lookups.php.

LOW 28

Cross Site Scripting (XSS) vulnerability in InvoicePlane 1.6 via filter_product input to file modal_product_lookups.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00526 Published 2023-02-07 No fix listed CWE-79

TI-2018-08791 CVE-2018-12255 · GHSA-vq3j-287q-qww3

An XSS issue was discovered in InvoicePlane 1.5.10 via the "Quote PDF Password(Optional)" field.

LOW 28

An XSS issue was discovered in InvoicePlane 1.5.10 via the "Quote PDF Password(Optional)" field.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00717 Published 2018-07-03 No fix listed CWE-79

TI-2021-09918 CVE-2021-29023 · GHSA-q62q-p9mg-92r4

InvoicePlane 1.5.11 doesn't have any rate-limiting for password reset and the reset token…

LOW 26

InvoicePlane 1.5.11 doesn't have any rate-limiting for password reset and the reset token is generated using a weak mechanism that is predictable.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01152 Published 2021-05-17 No fix listed CWE-307

TI-2021-09917 CVE-2021-29022 · GHSA-43xw-wcqh-j8wq

In InvoicePlane 1.5.11, the upload feature discloses the full path of the file upload directory.

LOW 26

In InvoicePlane 1.5.11, the upload feature discloses the full path of the file upload directory.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01081 Published 2021-05-10 No fix listed CWE-434

TI-2019-05119 CVE-2019-7223 · GHSA-vg3f-f2hm-54wp

InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoice_password…

LOW 26

InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoice_password parameter, aka the "PDF password" field to the "Create Invoice" option.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00667 Published 2019-03-16 No fix listed CWE-79

TI-2024-11578 CVE-2024-12478 · GHSA-39f8-7xx8-77ch

InvoicePlane 1 upload_file unrestricted upload

LOW 25

A vulnerability was found in InvoicePlane up to 1.6.1.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00571 Published 2024-12-16 No fix listed CWE-284

Open these records in search →