TI-2026-34278 CVE-2026-46622
SolidInvoice: API tokens stored as plaintext in the database allowing full credential compromise on database breach
Priority HIGH 70
SolidInvoice is an open-source invoicing platform.
SolidInvoice
Records13All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9
Exploited now
SolidInvoice records in CISA KEVNo SolidInvoice vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
13 records
TI-2026-34188 CVE-2026-46489
SolidInvoice: Unrestricted file upload with no MIME validation allows stored XSS via malicious SVG logo
Priority HIGH 70
SolidInvoice is an open-source invoicing platform.
TI-2026-44163 CVE-2026-61686
SolidInvoice: PHP unserialize() called on client-controlled data in DataGrid LiveComponent context prop
Priority HIGH 68
SolidInvoice is an open-source invoicing platform.
TI-2026-44165 CVE-2026-61688
SolidInvoice allows cross-user access to API token request history via writable DataGrid LiveComponent props
Priority MEDIUM 62
SolidInvoice is an open-source invoicing platform.
TI-2025-35046 CVE-2025-55580 · GHSA-f9jq-jw9w-3752
SolidInvoice version 2.3.7 is vulnerable to a stored cross-site scripting (XSS) issue in…
Priority MEDIUM 58
SolidInvoice version 2.3.7 is vulnerable to a stored cross-site scripting (XSS) issue in the Clients module.
TI-2025-35045 CVE-2025-55579 · GHSA-ff6v-2cx8-mf3h
SolidInvoice version 2.3.7 is vulnerable to a Stored Cross-Site Scripting (XSS) issue in…
Priority MEDIUM 58
SolidInvoice version 2.3.7 is vulnerable to a Stored Cross-Site Scripting (XSS) issue in the Tax Rates functionality.
TI-2025-08409 CVE-2025-9171 · GHSA-9xqq-4chh-p6q2
SolidInvoice Clients clients cross site scripting
Priority MEDIUM 56
A security flaw has been discovered in SolidInvoice up to 2.4.0.
TI-2025-08408 CVE-2025-9170 · GHSA-4jg7-26wv-9mgv
SolidInvoice Tax Rates rates cross site scripting
Priority MEDIUM 56
A vulnerability was identified in SolidInvoice up to 2.4.0.
TI-2025-08407 CVE-2025-9169 · GHSA-48jf-v4rx-6m25
SolidInvoice Quote quotes cross site scripting
Priority MEDIUM 56
A vulnerability was determined in SolidInvoice up to 2.4.0.
TI-2025-08406 CVE-2025-9168 · GHSA-892j-v748-7fwj
SolidInvoice Invoice Creation invoice cross site scripting
Priority MEDIUM 56
A vulnerability was found in SolidInvoice up to 2.4.0.
TI-2025-08405 CVE-2025-9167 · GHSA-37cw-49fx-hw6w
SolidInvoice Recurring Invoice recurring cross site scripting
Priority MEDIUM 56
A vulnerability has been found in SolidInvoice up to 2.4.0.
TI-2026-44130 CVE-2026-61608
Insufficient session expiration in SolidInvoice
Priority LOW 32
SolidInvoice is an open-source invoicing platform.
TI-2026-44134 CVE-2026-61614
SolidInvoice's long-lived API tokens accepted as URL query parameters, exposing…
Priority LOW 27
SolidInvoice is an open-source invoicing platform.