InvoiceShelf vulnerabilities
11 published CVEs name InvoiceShelf among the affected products.
- Published CVEs
- 11
- Last 12 months
- 11
- Critical
- 0
- Known exploited
- 0
Critical 0High 9Medium 2Low 0Not scored 0
Newest CVEs
- CVE-2026-55382
InvoiceShelf: Cross-company read/modify/delete of notes via missing company scope in NotePolicy (BOLA/IDOR)
InvoiceShelf · InvoiceShelf
High7.6 - CVE-2026-55385
InvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configuration
InvoiceShelf · InvoiceShelf
Medium6.8 - CVE-2026-55381
InvoiceShelf: IDOR in InvoiceShelf estimate-to-invoice conversion allows any company user to read and tamper with other companies' estimates
InvoiceShelf · InvoiceShelf
High7.1 - CVE-2026-55383
InvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosure
InvoiceShelf · InvoiceShelf
High8.2 - CVE-2026-55387
InvoiceShelf bulk deletion lacks company scoping
InvoiceShelf · InvoiceShelf
High7.2 - CVE-2026-55386
InvoiceShelf ORDER BY SQL injection through orderByField
InvoiceShelf · InvoiceShelf
High7.1 - CVE-2026-55384
InvoiceShelf trusts client-supplied document totals
InvoiceShelf · InvoiceShelf
Medium5.3 - CVE-2026-55610
InvoiceShelf has cross-company user read/update IDOR that enables cross-tenant account takeover
InvoiceShelf · InvoiceShelf
High8.7 - CVE-2026-34367
InvoiceShelf: SSRF in Invoice PDF Rendering via Unsanitised HTML in Notes Field
InvoiceShelf · InvoiceShelf
High7.6 - CVE-2026-34366
InvoiceShelf: SSRF in Payment Receipt PDF Rendering via Unsanitised HTML in Notes Field
InvoiceShelf · InvoiceShelf
High7.6