Vulnerabilities

TI-2026-82247 CVE-2026-55561

Guest user IDOR in InvoicePlane quote approval and rejection

MEDIUM 57

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00275 Published 2026-10-28 Fixed in 1.7.2-beta-1 CWE-639

TI-2026-64665 CVE-2026-100392

InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)

MEDIUM 64

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 4.0HIGH 7.0 Network High privileges No interaction EPSS 0.00285 Published 2026-09-28 No fix listed CWE-863

TI-2026-64649 CVE-2026-100371

Incorrect authorization in InvoicePlane

HIGH 77

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00351 Published 2026-09-28 No fix listed CWE-863

TI-2026-60029 CVE-2026-88003

InvoicePlane: Failure to Revoke Administrative Privileges After Role Downgrade

HIGH 68

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 4.0HIGH 7.5 Network High privileges No interaction EPSS 0.00378 Published 2026-09-25 Fixed in 1.7.2 CWE-863

TI-2026-36754 CVE-2026-49850

InvoicePlane: Missing CSRF Protection on State-Changing delete Actions

LOW 35

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00325 Published 2026-09-25 Fixed in 1.7.2 CWE-22

TI-2026-37269 CVE-2026-50547

InvoicePlane permits local file inclusion through the e-invoice XML configuration identifier

LOW 35

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00465 Published 2026-09-25 Fixed in 1.7.2 CWE-22

TI-2026-26020 CVE-2026-33639

InvoicePlane permits DDL injection through tax_rate_decimal_places

HIGH 67

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00507 Published 2026-09-25 Fixed in 1.7.2 CWE-89

TI-2026-28341 CVE-2026-39353

InvoicePlane: Remote Code Execution via Writable Templates Directory

HIGH 74

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00448 Published 2026-09-25 Fixed in 1.7.2-rc-1 CWE-693

TI-2026-58572 CVE-2026-85293

InvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer Forms

MEDIUM 55

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00225 Published 2026-09-25 Fixed in 1.7.2 CWE-79

TI-2026-58570 CVE-2026-85291

InvoicePlane IDOR: Horizontal Privilege Escalation via Password Change Without Authorization Check

MEDIUM 64

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00324 Published 2026-09-25 Fixed in 1.7.2 CWE-639

TI-2026-58568 CVE-2026-85289

InvoicePlane: Missing CSRF Token Validation on Multiple Delete Endpoints

MEDIUM 62

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00168 Published 2026-09-25 Fixed in 1.7.2 CWE-352

TI-2026-58571 CVE-2026-85292

InvoicePlane: Loose Type Comparison in Core Authentication Check (Defense-in-Depth)

LOW 22

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00253 Published 2026-09-25 Fixed in 1.7.2 CWE-697

TI-2026-58565 CVE-2026-85274

InvoicePlane: Recurring Invoice State Change via GET Request Without CSRF Protection

MEDIUM 62

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00168 Published 2026-09-25 Fixed in 1.7.2 CWE-352

TI-2026-58569 CVE-2026-85290

InvoicePlane: Log Injection via Unsanitized User Input in Cron Key Error Logging

MEDIUM 63

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00291 Published 2026-09-25 Fixed in 1.7.2 CWE-117

TI-2026-28359 CVE-2026-39372

InvoicePlane: Sensitive Information Disclosure via Unstripped EXIF Metadata in Attachments

MEDIUM 56

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00353 Published 2026-09-25 Fixed in 1.7.2 CWE-200

TI-2026-39596 CVE-2026-54790

InvoicePlane: Second-order SQL injection through the unvalidated custom_field_table field in the Custom Fields module

MEDIUM 60

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1MEDIUM 6.0 Network High privileges No interaction EPSS 0.00283 Published 2026-09-25 Fixed in 1.7.2 CWE-89

TI-2026-21250 CVE-2026-26281

InvoicePlane has Stored Cross-Site Scripting (XSS) Issue in Sumex Invoice View

MEDIUM 54

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1MEDIUM 4.4 Network Low privileges User interaction EPSS 0.00212 Published 2026-02-18 No fix listed CWE-79

TI-2026-21240 CVE-2026-26270

InvoicePlane has Stored Cross-Site Scripting Issue in Identifier Formatting

MEDIUM 58

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00204 Published 2026-02-18 No fix listed CWE-79

TI-2026-20703 CVE-2026-25596

InvoicePlane has Stored XSS via Product Unit Name in Invoice Item List

MEDIUM 55

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00242 Published 2026-02-18 No fix listed CWE-79

TI-2026-20702 CVE-2026-25595

InvoicePlane has Stored XSS via Invoice Number in Invoice View and Dashboard

LOW 22

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00242 Published 2026-02-18 No fix listed CWE-79

TI-2026-20701 CVE-2026-25594

InvoicePlane has Stored XSS via Family Name in Product Form

LOW 22

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00247 Published 2026-02-18 No fix listed CWE-79

TI-2026-20657 CVE-2026-25548

InvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoning

MEDIUM 43

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.0086 Published 2026-02-18 No fix listed CWE-117

TI-2026-19950 CVE-2026-24745

InvoicePlane has a Stored Cross-Site Scripting (XSS) issue

HIGH 66

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1HIGH 7.5 Network High privileges User interaction EPSS 0.00262 Published 2026-02-18 No fix listed CWE-79

TI-2026-19949 CVE-2026-24744

InvoicePlane has a Stored Cross-Site Scripting (XSS) issue

HIGH 66

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1HIGH 7.5 Network High privileges User interaction EPSS 0.00262 Published 2026-02-18 No fix listed CWE-79

TI-2026-19948 CVE-2026-24743

InvoicePlane has a Stored Cross-Site Scripting (XSS) issue

HIGH 66

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVSS 3.1HIGH 7.5 Network High privileges User interaction EPSS 0.00262 Published 2026-02-18 No fix listed CWE-79

Vulnerabilities

Filters