IInvoicePlane

Products

Exploited and recent CVEs

• CVE-2026-55561 Medium 5.3 InvoicePlane: Guest user IDOR in quote approval and rejection 0.3%
• CVE-2026-100392 High 7.0 InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization) 0.3%
• CVE-2026-100371 High 8.7 InvoicePlane: Incomplete Authorization Remediation in Users::form() Enables Primary Administrator Account Takeover via Email Reassignment and Password Recovery 0.4%
• CVE-2026-88003 High 7.5 InvoicePlane: Failure to Revoke Administrative Privileges After Role Downgrade 0.4%
• CVE-2026-49850 High 7.5 InvoicePlane: Missing CSRF Protection on State-Changing delete Actions 0.3%
• CVE-2026-50547 High 7.5 InvoicePlane permits local file inclusion through the e-invoice XML configuration identifier 0.5%
• CVE-2026-33639 High 7.2 InvoicePlane permits DDL injection through tax_rate_decimal_places 0.5%
• CVE-2026-39353 Critical 9.1 InvoicePlane: Remote Code Execution via Writable Templates Directory 0.4%
• CVE-2026-85293 Medium 4.8 InvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer Forms 0.2%
• CVE-2026-85291 Medium 6.5 InvoicePlane IDOR: Horizontal Privilege Escalation via Password Change Without Authorization Check 0.3%
• CVE-2026-85289 Medium 6.5 InvoicePlane: Missing CSRF Token Validation on Multiple Delete Endpoints 0.2%
• CVE-2026-85292 Medium 4.8 InvoicePlane: Loose Type Comparison in Core Authentication Check (Defense-in-Depth) 0.3%
• CVE-2026-85274 Medium 6.5 InvoicePlane: Recurring Invoice State Change via GET Request Without CSRF Protection 0.2%
• CVE-2026-85290 Medium 5.3 InvoicePlane: Log Injection via Unsanitized User Input in Cron Key Error Logging 0.3%
• CVE-2026-39372 Medium 4.9 InvoicePlane: Sensitive Information Disclosure via Unstripped EXIF Metadata in Attachments 0.4%
• CVE-2026-54790 Medium 6.0 InvoicePlane: Second-order SQL injection through the unvalidated custom_field_table field in the Custom Fields module 0.3%
• CVE-2026-26281 Medium 4.4 InvoicePlane has Stored Cross-Site Scripting (XSS) Issue in Sumex Invoice View 0.2%
• CVE-2026-26270 Medium 5.4 InvoicePlane has Stored Cross-Site Scripting Issue in Identifier Formatting 0.2%
• CVE-2026-25596 Medium 4.8 InvoicePlane has Stored XSS via Product Unit Name in Invoice Item List 0.2%
• CVE-2026-25595 Medium 4.8 InvoicePlane has Stored XSS via Invoice Number in Invoice View and Dashboard 0.2%
• CVE-2026-25594 Medium 4.8 InvoicePlane has Stored XSS via Family Name in Product Form 0.2%
• CVE-2026-25548 Critical 9.1 InvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoning 0.9%
• CVE-2026-24745 Medium 5.7 InvoicePlane has a Stored Cross-Site Scripting (XSS) issue 0.3%
• CVE-2026-24744 Medium 5.7 InvoicePlane has a Stored Cross-Site Scripting (XSS) issue 0.3%
• CVE-2026-24743 Medium 5.7 InvoicePlane has a Stored Cross-Site Scripting (XSS) issue 0.3%
• CVE-2026-24746 Medium 5.7 InvoicePlane has a Stored Cross-Site Scripting (XSS) issue 0.3%
• CVE-2026-23491 Critical 9.3 InvoicePlane has Unauthenticated Path Traversal in Guest Controller 4.6%