Login Request a demo
IN
Vendor
InvoicePlane
1 product with CVEs on record
45
CVEs
0
On KEV
1
New 30D
Products
IN
InvoicePlane
InvoicePlane
9.9
45 CVEs0 on KEV1 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-55561
New
IN
InvoicePlane
InvoicePlane
5.3–Oct 28InvoicePlane: Guest user IDOR in quote approval and rejection
CVE-2026-100392
IN
InvoicePlane
InvoicePlane
7.0
0%
Sep 28InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)
CVE-2026-100371
IN
InvoicePlane
InvoicePlane
8.7
0%
Sep 28InvoicePlane: Incomplete Authorization Remediation in Users::form() Enables Primary Administrator Account Takeover via Email Reassignment and Password Recovery
CVE-2026-88003
IN
InvoicePlane
InvoicePlane
7.5
0%
Sep 25InvoicePlane: Failure to Revoke Administrative Privileges After Role Downgrade
CVE-2026-49850
IN
InvoicePlane
InvoicePlane
7.5
0%
Sep 25InvoicePlane: Missing CSRF Protection on State-Changing delete Actions
CVE-2026-50547
IN
InvoicePlane
InvoicePlane
7.5
0%
Sep 25InvoicePlane permits local file inclusion through the e-invoice XML configuration identifier
CVE-2026-33639
IN
InvoicePlane
InvoicePlane
7.2
1%
Sep 25InvoicePlane permits DDL injection through tax_rate_decimal_places
CVE-2026-39353
IN
InvoicePlane
InvoicePlane
9.1
0%
Sep 25InvoicePlane: Remote Code Execution via Writable Templates Directory
CVE-2026-85293
IN
InvoicePlane
InvoicePlane
4.8
0%
Sep 25InvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer Forms
CVE-2026-85291
IN
InvoicePlane
InvoicePlane
6.5
0%
Sep 25InvoicePlane IDOR: Horizontal Privilege Escalation via Password Change Without Authorization Check
CVE-2026-85289
IN
InvoicePlane
InvoicePlane
6.5
0%
Sep 25InvoicePlane: Missing CSRF Token Validation on Multiple Delete Endpoints
CVE-2026-85292
IN
InvoicePlane
InvoicePlane
4.8
0%
Sep 25InvoicePlane: Loose Type Comparison in Core Authentication Check (Defense-in-Depth)
CVE-2026-85274
IN
InvoicePlane
InvoicePlane
6.5
0%
Sep 25InvoicePlane: Recurring Invoice State Change via GET Request Without CSRF Protection
CVE-2026-85290
IN
InvoicePlane
InvoicePlane
5.3
0%
Sep 25InvoicePlane: Log Injection via Unsanitized User Input in Cron Key Error Logging
CVE-2026-39372
IN
InvoicePlane
InvoicePlane
4.9
0%
Sep 25InvoicePlane: Sensitive Information Disclosure via Unstripped EXIF Metadata in Attachments
CVE-2026-54790
IN
InvoicePlane
InvoicePlane
6.0
0%
Sep 25InvoicePlane: Second-order SQL injection through the unvalidated custom_field_table field in the Custom Fields module
CVE-2026-26281
IN
InvoicePlane
InvoicePlane
4.4
0%
Feb 18InvoicePlane has Stored Cross-Site Scripting (XSS) Issue in Sumex Invoice View
CVE-2026-26270
IN
InvoicePlane
InvoicePlane
5.4
0%
Feb 18InvoicePlane has Stored Cross-Site Scripting Issue in Identifier Formatting
CVE-2026-25596
IN
InvoicePlane
InvoicePlane
4.8
0%
Feb 18InvoicePlane has Stored XSS via Product Unit Name in Invoice Item List
CVE-2026-25595
IN
InvoicePlane
InvoicePlane
4.8
0%
Feb 18InvoicePlane has Stored XSS via Invoice Number in Invoice View and Dashboard
CVE-2026-25594
IN
InvoicePlane
InvoicePlane
4.8
0%
Feb 18InvoicePlane has Stored XSS via Family Name in Product Form
CVE-2026-25548
IN
InvoicePlane
InvoicePlane
9.1
1%
Feb 18InvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoning
CVE-2026-24745
IN
InvoicePlane
InvoicePlane
7.5
0%
Feb 18InvoicePlane has a Stored Cross-Site Scripting (XSS) issue
CVE-2026-24744
IN
InvoicePlane
InvoicePlane
7.5
0%
Feb 18InvoicePlane has a Stored Cross-Site Scripting (XSS) issue
CVE-2026-24743
IN
InvoicePlane
InvoicePlane
7.5
0%
Feb 18InvoicePlane has a Stored Cross-Site Scripting (XSS) issue
CVE-2026-24746
IN
InvoicePlane
InvoicePlane
7.5
0%
Feb 18InvoicePlane has a Stored Cross-Site Scripting (XSS) issue
CVE-2026-23491
IN
InvoicePlane
InvoicePlane
7.5
5%
Feb 18InvoicePlane has Unauthenticated Path Traversal in Guest Controller
CVE-2025-67082
IN
Invoiceplane
Invoiceplane
6.5
0%
Jan 15An SQL injection vulnerability in InvoicePlane through 1.6.3 has been identified in "maxQuantity" and "minQuantity" parameters when generating a report
CVE-2025-67083
IN
Invoiceplane
Invoiceplane
5.3
1%
Jan 15Directory traversal vulnerability in InvoicePlane through 1.6.3 allows unauthenticated attackers to read files from the server
CVE-2025-67084
IN
Invoiceplane
Invoiceplane
9.9
0%
Jan 15File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely,…
CVE-2025-64012
IN
Invoiceplane
Invoiceplane
4.3
0%
Dec 16InvoicePlane commit debb446c is vulnerable to Incorrect Access Control
CVE-2024-56975
IN
Invoiceplane
Invoiceplane
9.8
1%
Mar 28InvoicePlane (all versions tested as of December 2024) v.1.6.11 and before contains a remote code execution vulnerability in the upload_file method of the Upload controller
CVE-2024-12667
IN
Invoiceplane
Invoiceplane
5.9
1%
Dec 16InvoicePlane view session expiration
CVE-2024-12478
IN
Invoiceplane
Invoiceplane
8.8
1%
Dec 16InvoicePlane 1 upload_file unrestricted upload
CVE-2024-12362
IN
Invoiceplane
Invoiceplane
4.3
1%
Dec 16InvoicePlane invoices.php download path traversal
CVE-2023-23011
IN
Invoiceplane
Invoiceplane
6.1
1%
Feb 7Cross Site Scripting (XSS) vulnerability in InvoicePlane 1.6 via filter_product input to file modal_product_lookups.php
CVE-2021-29024
IN
Invoiceplane
Invoiceplane
7.5
2%
May 17In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and file download
CVE-2021-29023
IN
Invoiceplane
Invoiceplane
5.3
1%
May 17InvoicePlane 1.5.11 doesn't have any rate-limiting for password reset and the reset token is generated using a weak mechanism that is predictable
CVE-2021-29022
IN
Invoiceplane
Invoiceplane
5.3
1%
May 10In InvoicePlane 1.5.11, the upload feature discloses the full path of the file upload directory
CVE-2019-7223
IN
Invoiceplane
Invoiceplane
5.4
1%
Mar 16InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoice_password parameter, aka the "PDF password" field to the "Create Invoice" option
CVE-2018-12255
IN
Invoiceplane
Invoiceplane
6.1
1%
Jul 3An XSS issue was discovered in InvoicePlane 1.5.10 via the "Quote PDF Password(Optional)" field
CVE-2017-18217
IN
Invoiceplane
Invoiceplane
6.1
1%
Mar 5An issue was discovered in InvoicePlane before 1.5.5
CVE-2017-1000508
IN
Invoiceplane
Invoiceplane
6.1
1%
Feb 9Invoice Plane version 1.5.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in Client's details that can result in execution of javascript code
CVE-2017-1000239
IN
Invoiceplane
Invoiceplane
5.4
0%
Nov 17InvoicePlane version 1.4.10 is vulnerable to a Stored Cross Site Scripting resulting in allowing an authenticated user to inject malicious client side script which will be…
CVE-2017-1000238
IN
Invoiceplane
Invoiceplane
8.8
1%
Nov 17InvoicePlane version 1.4.10 is vulnerable to a Arbitrary File Upload resulting in an authenticated user can upload a malicious file to the webserver