InvoicePlane vulnerabilities

27 published CVEs name InvoicePlane among the affected products.

Critical 3High 6Medium 18Low 0Not scored 0

Newest CVEs

CVE-2026-55561
InvoicePlane: Guest user IDOR in quote approval and rejection
InvoicePlane · InvoicePlane
Medium5.3
CVE-2026-100392
InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)
InvoicePlane · InvoicePlane
High7.0
CVE-2026-100371
InvoicePlane: Incomplete Authorization Remediation in Users::form() Enables Primary Administrator Account Takeover via Email Reassignment and Password Recovery
InvoicePlane · InvoicePlane
High8.7
CVE-2026-88003
InvoicePlane: Failure to Revoke Administrative Privileges After Role Downgrade
InvoicePlane · InvoicePlane
High7.5
CVE-2026-49850
InvoicePlane: Missing CSRF Protection on State-Changing delete Actions
InvoicePlane · InvoicePlane
High7.5
CVE-2026-50547
InvoicePlane permits local file inclusion through the e-invoice XML configuration identifier
InvoicePlane · InvoicePlane
High7.5
CVE-2026-33639
InvoicePlane permits DDL injection through tax_rate_decimal_places
InvoicePlane · InvoicePlane
High7.2
CVE-2026-39353
InvoicePlane: Remote Code Execution via Writable Templates Directory
InvoicePlane · InvoicePlane
Critical9.1
CVE-2026-85293
InvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer Forms
InvoicePlane · InvoicePlane
Medium4.8
CVE-2026-85291
InvoicePlane IDOR: Horizontal Privilege Escalation via Password Change Without Authorization Check
InvoicePlane · InvoicePlane
Medium6.5