Vulnerabilities

TI-2026-74458 CVE-2026-55382

InvoiceShelf lets staff read, change and delete other companies' notes

LOW 33

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00382 Published 2026-10-14 Fixed in 2.4.0 CWE-639

TI-2026-74461 CVE-2026-55385

Server-side request forgery in InvoiceShelf PDF configuration

MEDIUM 63

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates.

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00576 Published 2026-10-14 Fixed in 2.4.0 CWE-918

TI-2026-74457 CVE-2026-55381

Missing access check in InvoiceShelf estimate conversion

MEDIUM 64

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00364 Published 2026-10-14 Fixed in 2.4.0 CWE-639

TI-2026-74459 CVE-2026-55383

InvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosure

HIGH 75

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00423 Published 2026-10-14 Fixed in 2.4.0 CWE-285

TI-2026-74463 CVE-2026-55387

InvoiceShelf bulk deletion lets users delete other companies' records

HIGH 65

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates.

CVSS 4.0HIGH 7.2 Network Low privileges No interaction EPSS 0.00433 Published 2026-10-14 Fixed in 2.4.0 CWE-284

TI-2026-74462 CVE-2026-55386

SQL injection in InvoiceShelf ORDER BY clause exposes database data

MEDIUM 64

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00363 Published 2026-10-14 Fixed in 2.4.0 CWE-89

TI-2026-74460 CVE-2026-55384

InvoiceShelf accepts unchecked client-supplied invoice totals

LOW 24

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00279 Published 2026-10-14 Fixed in 2.4.0 CWE-284

TI-2026-40143 CVE-2026-55610

InvoiceShelf has cross-company user read/update IDOR that enables cross-tenant account takeover

MEDIUM 40

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates.

CVSS 3.1HIGH 8.7 Network High privileges No interaction EPSS 0.00428 Published 2026-09-23 Fixed in 2.4.1 CWE-639

TI-2026-26653 CVE-2026-34367

InvoiceShelf: SSRF in Invoice PDF Rendering via Unsanitised HTML in Notes Field

HIGH 71

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates.

CVSS 3.1HIGH 8.7 Network High privileges No interaction EPSS 0.00272 Published 2026-03-31 Fixed in 2.2.0 CWE-918

TI-2026-26652 CVE-2026-34366

InvoiceShelf: SSRF in Payment Receipt PDF Rendering via Unsanitised HTML in Notes Field

HIGH 68

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00249 Published 2026-03-31 Fixed in 2.2.0 CWE-918

TI-2026-26651 CVE-2026-34365

InvoiceShelf: SSRF in Estimate PDF Rendering via Unsanitised HTML in Notes Field

HIGH 68

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00249 Published 2026-03-31 Fixed in 2.2.0 CWE-918

Vulnerabilities

Filters