Vulnerability · Published Oct 14, 2026 · Assigned by GitHub_M

CVE-2026-55386InvoiceShelf ORDER BY SQL injection through orderByField

High 7.1

In plain English

A high-severity SQL injection in InvoiceShelf from InvoiceShelf. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.4%top 69.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf passes the authenticated user's orderByField query parameter into Laravel orderBy calls in Invoice::scopeApplyFilters without restricting the value to column identifiers. A crafted SQL expression can therefore enter the ORDER BY clause across invoice and other list endpoints, enabling boolean-based blind extraction of database information. This issue is fixed in version 2.4.0.

Affected products (as reported)

Vendor	Product	Versions
InvoiceShelf	InvoiceShelf	< 2.4.0

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-cp8p-jcqf-j39c x_refsource_CONFIRM
https://github.com/InvoiceShelf/InvoiceShelf/pull/663 x_refsource_MISC
https://github.com/InvoiceShelf/InvoiceShelf/commit/e92b08ef6af7d0d0cd5183df81f795f7fbf4f4fc x_refsource_MISC
https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0 x_refsource_MISC