Log in Start free

InvoiceShelf

Products

ProductCVEsExploitedLatest
InvoiceShelf11–Oct 14, 2026

Exploited and recent CVEs

  • CVE-2026-55382 High 7.6 InvoiceShelf: Cross-company read/modify/delete of notes via missing company scope in NotePolicy (BOLA/IDOR) 0.4%
  • CVE-2026-55385 Medium 6.8 InvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configuration 0.6%
  • CVE-2026-55381 High 7.1 InvoiceShelf: IDOR in InvoiceShelf estimate-to-invoice conversion allows any company user to read and tamper with other companies' estimates 0.4%
  • CVE-2026-55383 High 8.2 InvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosure 0.4%
  • CVE-2026-55387 High 7.2 InvoiceShelf bulk deletion lacks company scoping 0.4%
  • CVE-2026-55386 High 7.1 InvoiceShelf ORDER BY SQL injection through orderByField 0.4%
  • CVE-2026-55384 Medium 5.3 InvoiceShelf trusts client-supplied document totals 0.3%
  • CVE-2026-55610 High 8.7 InvoiceShelf has cross-company user read/update IDOR that enables cross-tenant account takeover 0.4%
  • CVE-2026-34367 High 7.6 InvoiceShelf: SSRF in Invoice PDF Rendering via Unsanitised HTML in Notes Field 0.3%
  • CVE-2026-34366 High 7.6 InvoiceShelf: SSRF in Payment Receipt PDF Rendering via Unsanitised HTML in Notes Field 0.2%
  • CVE-2026-34365 High 7.6 InvoiceShelf: SSRF in Estimate PDF Rendering via Unsanitised HTML in Notes Field 0.2%