Vulnerabilities

TI-2026-44165 CVE-2026-61688

SolidInvoice allows cross-user access to API token request history via writable DataGrid LiveComponent props

MEDIUM 62

SolidInvoice is an open-source invoicing platform.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00354 Published 2026-09-04 Fixed in 3.0.1 CWE-639

TI-2026-44134 CVE-2026-61614

SolidInvoice's long-lived API tokens accepted as URL query parameters, exposing…

LOW 27

SolidInvoice is an open-source invoicing platform.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00366 Published 2026-09-04 Fixed in 3.0.1 CWE-598

TI-2026-44130 CVE-2026-61608

Insufficient session expiration in SolidInvoice

LOW 32

SolidInvoice is an open-source invoicing platform.

CVSS 3.1MEDIUM 6.8 Network No auth User interaction EPSS 0.00321 Published 2026-09-04 Fixed in 3.0.1 CWE-613

TI-2026-44163 CVE-2026-61686

SolidInvoice: PHP unserialize() called on client-controlled data in DataGrid LiveComponent context prop

HIGH 68

SolidInvoice is an open-source invoicing platform.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.0045 Published 2026-09-04 Fixed in 3.0.1 CWE-502

TI-2026-34188 CVE-2026-46489

SolidInvoice: Unrestricted file upload with no MIME validation allows stored XSS via malicious SVG logo

HIGH 70

SolidInvoice is an open-source invoicing platform.

CVSS 3.1HIGH 8.1 Network High privileges User interaction EPSS 0.0031 Published 2026-06-11 Fixed in 2.3.17 CWE-434

TI-2026-34278 CVE-2026-46622

SolidInvoice: API tokens stored as plaintext in the database allowing full credential compromise on database breach

HIGH 70

SolidInvoice is an open-source invoicing platform.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00197 Published 2026-06-11 Fixed in 2.3.17 CWE-312

TI-2025-35046 CVE-2025-55580 · GHSA-f9jq-jw9w-3752

SolidInvoice version 2.3.7 is vulnerable to a stored cross-site scripting (XSS) issue in…

MEDIUM 58

SolidInvoice version 2.3.7 is vulnerable to a stored cross-site scripting (XSS) issue in the Clients module.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00267 Published 2025-08-29 No fix listed CWE-79

TI-2025-35045 CVE-2025-55579 · GHSA-ff6v-2cx8-mf3h

SolidInvoice version 2.3.7 is vulnerable to a Stored Cross-Site Scripting (XSS) issue in…

MEDIUM 58

SolidInvoice version 2.3.7 is vulnerable to a Stored Cross-Site Scripting (XSS) issue in the Tax Rates functionality.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00268 Published 2025-08-29 No fix listed CWE-79

TI-2025-08409 CVE-2025-9171 · GHSA-9xqq-4chh-p6q2

SolidInvoice Clients clients cross site scripting

MEDIUM 56

A security flaw has been discovered in SolidInvoice up to 2.4.0.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00305 Published 2025-08-19 No fix listed CWE-79

TI-2025-08408 CVE-2025-9170 · GHSA-4jg7-26wv-9mgv

SolidInvoice Tax Rates rates cross site scripting

MEDIUM 56

A vulnerability was identified in SolidInvoice up to 2.4.0.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00305 Published 2025-08-19 No fix listed CWE-79

TI-2025-08407 CVE-2025-9169 · GHSA-48jf-v4rx-6m25

SolidInvoice Quote quotes cross site scripting

MEDIUM 56

A vulnerability was determined in SolidInvoice up to 2.4.0.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00305 Published 2025-08-19 No fix listed CWE-79

TI-2025-08406 CVE-2025-9168 · GHSA-892j-v748-7fwj

SolidInvoice Invoice Creation invoice cross site scripting

MEDIUM 56

A vulnerability was found in SolidInvoice up to 2.4.0.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00305 Published 2025-08-19 No fix listed CWE-79

TI-2025-08405 CVE-2025-9167 · GHSA-37cw-49fx-hw6w

SolidInvoice Recurring Invoice recurring cross site scripting

MEDIUM 56

A vulnerability has been found in SolidInvoice up to 2.4.0.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00305 Published 2025-08-19 No fix listed CWE-79

Vulnerabilities

Filters