CVE-2026-26281 | Medium | 4.4 | 2026-02-18 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A stored cross-site scripting (XSS) vulnerability in the Su… |
CVE-2026-26270 | Medium | 5.4 | 2026-02-18 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in… |
CVE-2026-25596 | Medium | 4.8 | 2026-02-18 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in… |
CVE-2026-25595 | Medium | 4.8 | 2026-02-18 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in… |
CVE-2026-25594 | Medium | 4.8 | 2026-02-18 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in… |
CVE-2026-25548 | Critical | 9.1 | 2026-02-18 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A critical Remote Code Execution (RCE) vulnerability exists… |
CVE-2026-24745 | Medium | 5.7 | 2026-02-18 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in… |
CVE-2026-24744 | Medium | 5.7 | 2026-02-18 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in… |
CVE-2026-24743 | Medium | 5.7 | 2026-02-18 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in… |
CVE-2026-24746 | Medium | 5.7 | 2026-02-18 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in… |
CVE-2026-23491 | High | 7.5 | 2026-02-18 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A path traversal vulnerability exists in the `get_file` met… |
CVE-2025-67084 | Critical | 9.9 | 2026-01-15 | File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be execu… |
CVE-2025-67083 | Medium | 5.3 | 2026-01-15 | Directory traversal vulnerability in InvoicePlane through 1.6.3 allows unauthenticated attackers to read files from the server. The ability to read files and t… |
CVE-2025-67082 | Medium | 6.5 | 2026-01-15 | An SQL injection vulnerability in InvoicePlane through 1.6.3 has been identified in "maxQuantity" and "minQuantity" parameters when generating a report. An aut… |
CVE-2025-64012 | Medium | 4.3 | 2025-12-16 | InvoicePlane commit debb446c is vulnerable to Incorrect Access Control. The invoices/view handler fails to verify ownership before returning invoice data. |
CVE-2024-56975 | Critical | 9.8 | 2025-03-28 | InvoicePlane (all versions tested as of December 2024) v.1.6.11 and before contains a remote code execution vulnerability in the upload_file method of the Uplo… |
CVE-2024-12667 | Low | 3.7 | 2024-12-16 | A vulnerability was found in InvoicePlane up to 1.6.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /invoices… |
CVE-2024-12478 | Medium | 6.3 | 2024-12-16 | A vulnerability was found in InvoicePlane up to 1.6.1. It has been declared as critical. This vulnerability affects the function upload_file of the file /index… |
CVE-2024-12362 | Medium | 4.3 | 2024-12-16 | A vulnerability was found in InvoicePlane up to 1.6.1. It has been classified as problematic. This affects the function download of the file invoices.php. The… |
CVE-2023-23011 | Medium | 6.1 | 2023-02-07 | Cross Site Scripting (XSS) vulnerability in InvoicePlane 1.6 via filter_product input to file modal_product_lookups.php. |
CVE-2021-29024 | High | 7.5 | 2021-05-17 | In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and file download. Allowing an attacker to directory traversal and d… |
CVE-2021-29023 | Medium | 5.3 | 2021-05-17 | InvoicePlane 1.5.11 doesn't have any rate-limiting for password reset and the reset token is generated using a weak mechanism that is predictable. |
CVE-2021-29022 | Medium | 5.3 | 2021-05-10 | In InvoicePlane 1.5.11, the upload feature discloses the full path of the file upload directory. |
CVE-2019-7223 | Medium | 5.4 | 2019-03-21 | InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoice_password parameter, aka the "PDF password" field to the "Create Invoice" option. T… |
CVE-2018-12255 | Medium | 6.1 | 2018-07-03 | An XSS issue was discovered in InvoicePlane 1.5.10 via the "Quote PDF Password(Optional)" field. |
CVE-2017-18217 | Medium | 6.1 | 2018-03-05 | An issue was discovered in InvoicePlane before 1.5.5. It was observed that the Email address and Web address parameters are vulnerable to Cross Site Scripting… |
CVE-2017-1000508 | Medium | 6.1 | 2018-02-09 | Invoice Plane version 1.5.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in Client's details that can result in execution of javascript code… |
CVE-2017-1000239 | Medium | 5.4 | 2017-11-17 | InvoicePlane version 1.4.10 is vulnerable to a Stored Cross Site Scripting resulting in allowing an authenticated user to inject malicious client side script w… |
CVE-2017-1000238 | High | 8.8 | 2017-11-17 | InvoicePlane version 1.4.10 is vulnerable to a Arbitrary File Upload resulting in an authenticated user can upload a malicious file to the webserver. It is pos… |