Medium severity · published Mar 5, 2018
CVE-2017-18217
An issue was discovered in InvoicePlane before 1.5.5
6.1
CVSS
1.3%
EPSS
No
On KEV
Description
An issue was discovered in InvoicePlane before 1.5.5. It was observed that the Email address and Web address parameters are vulnerable to Cross Site Scripting, related to application/modules/clients/views/view.php, application/modules/invoices/views/view.php, and application/modules/quotes/views/view.php.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IN
Invoiceplane · Invoiceplane
before 1.5.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-18217
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-18217
Exploit
http://blog.isecurion.com/2018/04/23/invoice-plane-v1-5-cross-site-scripting-vulnerability/
Patch
https://github.com/InvoicePlane/InvoicePlane/pull/542
Patch
https://github.com/InvoicePlane/InvoicePlane/pull/551
More from Invoiceplane
9.9
CVE-2025-67084
File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely,…
9.8
CVE-2024-56975
InvoicePlane (all versions tested as of December 2024) v.1.6.11 and before contains a remote code execution vulnerability in the upload_file method of the Upload controller
9.1
CVE-2026-39353
InvoicePlane: Remote Code Execution via Writable Templates Directory
9.1
CVE-2026-25548
InvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoning
8.8
CVE-2024-12478
InvoicePlane 1 upload_file unrestricted upload