Invoiceplane
Monthly
Privilege destruction in InvoicePlane 1.7.2 allows an authenticated secondary administrator to demote the primary administrator account (user_id = 1) to a read-only Guest role by exploiting a missing object-level authorization check in the Users::form() endpoint. This locks the legitimate owner out of the instance. The vulnerability requires an attacker who already holds a secondary admin account (user_type = 1) and a deployment with more than one administrator; no public exploit code or active exploitation has been identified at time of analysis, and no vendor patch is currently available.
Account takeover of the InvoicePlane primary administrator (user_id=1) is possible for any authenticated secondary administrator (user_type=1, user_id != 1) on version 1.7.2 prior to commit 8616fa4. The attacker uses Users::form(), which performs no object-level authorization check on the primary admin's record, to overwrite the primary administrator's user_email value (it is not listed in PROTECTED_FIELDS), then drives the instance's public, logged-out password-recovery flow that resolves accounts by user_email to obtain the reset token and seize control of user_id=1. This is an alternate path around the earlier fix in PR #1638, which protected only Users::change_password(); no public exploit code was identified at time of analysis and there is no CISA KEV entry, but the vendor has published a GitHub Security Advisory (GHSA-77hm-22wp-96wp) and a patch commit.
Cross-site request forgery in InvoicePlane before 1.7.2 allows a remote, unauthenticated attacker to force deletion of invoice and invoice-tax records by inducing a logged-in administrator to load attacker-controlled content that invokes the Invoices::delete() or Invoices::delete_invoice_tax() routes. Those routes performed state-changing operations without requiring a POST method or validating a CSRF token, so the victim administrator's active session was sufficient to authorize the deletion (independent assessment: CVSS:3.1/AV:N/AC:L/PR:N/UI:R - integrity high, availability low, confidentiality none). No public exploit has been identified at time of analysis, and no confirmed active exploitation (CISA KEV) applies; despite the 7.5 base score, this is a moderate rather than high real-world priority because it requires administrator interaction and results only in removal of financial records, with the fix released in 1.7.2.
Local file inclusion in InvoicePlane before 1.7.2 allows an authenticated low-privileged user who can influence the e-invoice xml_id configuration to use path traversal sequences to include an existing .php file from the XMLconfigs helper directory. This is a moderate-priority, not urgent, finding: the advisory establishes local file inclusion, while full code execution would require a separate file-upload or file-write primitive, and no public exploit identified at time of analysis. The issue is fixed in version 1.7.2 via an allowlist on xml_id.
SQL injection in InvoicePlane's tax-rate settings allows an authenticated administrator to inject arbitrary SQL fragments into the ALTER TABLE statement that rebuilds the ip_tax_rates schema, letting them alter or drop required database columns in every release prior to 1.7.2. Because the malicious value is changed through the admin-only Settings page, exploitation requires high privileges (CVSS PR:H); the outcome is persistent schema corruption affecting financial data structures and potential loss of application availability, with integrity and availability impact rated high. No public exploit code has been identified at time of analysis, and the issue is resolved by upgrading to 1.7.2.
Remote code execution in InvoicePlane builds prior to 1.7.2-rc-1 allows an attacker who already holds InvoicePlane's administrator-controlled file-write capability to plant a malicious PHP file inside the PHP template directory that Mdl_templates automatically scans and trusts. That planted file can then be selected as public_invoice_template, and when any unauthenticated guest renders the corresponding public invoice, the guest View controller includes and executes it with web-server privileges - a CWE-98 PHP file-inclusion flaw with a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Exploitation is gated by the need for high-privilege file-write access (PR:H) even though the execution trigger is network-reachable and unauthenticated, and no public exploit code has been identified at time of analysis; the vendor fixes the issue in 1.7.2-rc-1 by replacing filesystem scanning with explicit allowlist constants.
Remote Code Execution in InvoicePlane self-hosted invoicing application through code injection. PoC and patch available.
Unauthenticated attackers can read arbitrary files from InvoicePlane servers through path traversal in the Guest controller's file retrieval function, potentially exposing database credentials and other sensitive configuration data. This vulnerability affects InvoicePlane versions up to 1.6.3 and has public exploit code available. Version 1.6.4 resolves the issue.
Stored cross-site scripting in InvoicePlane 1.7.2-beta-1 and earlier lets an authenticated administrator who can edit client records persist an attribute-breaking payload in the client_email field, which the invoice and quote mailer views then render unescaped inside a double-quoted to_email value attribute. When the mailer feature is configured for the affected client and a second authenticated administrator opens the related mailer page, the injected JavaScript runs in the InvoicePlane origin and can act with that victim's session. Exploitation requires two separate high-privilege admin accounts plus victim user interaction, which keeps this a genuine but low-priority issue; no public exploit code has been identified at time of analysis, and the flaw is fixed in version 1.7.2.
An insecure direct object reference in InvoicePlane's Users::change_password() endpoint (prior to 1.7.2) lets an authenticated secondary administrator replace the password of any other user account - most critically the primary administrator - without knowing or supplying the current password, resulting in full takeover of that account and its privileges. Exploitation requires an existing administrator-level session (CVSS PR:H) and a deployment with at least one other admin account to target, so this is a privilege-consolidation/lateral-movement flaw rather than an unauthenticated remote takeover; no public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited. Vendor-released patch: 1.7.2.
Cross-site request forgery in InvoicePlane versions prior to 1.7.2 lets an attacker force a logged-in administrator's browser to submit forged POST requests that permanently delete financial and configuration records - including payments, recurring invoices, client-user assignments, users, email templates, families, and import data. The destructive delete()/stop() methods omit the ensure_valid_post_request() CSRF token check that other parts of the application rely on, so although the routes accept only POST, they never validate the request's token; exploitation requires the victim administrator to visit attacker-controlled web content while holding a valid session (CVSS 3.1 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N). No public exploit code or confirmed active exploitation was identified at time of analysis, and the integrity impact is bounded to records the admin session could already delete - there is no data exfiltration, and deleted records may be recoverable from backups.
Authorization bypass in InvoicePlane versions prior to 1.7.2 lets unauthenticated remote attackers satisfy the application's primary role check when the instance is configured with a non-standard session backend that returns non-string scalar values for the session user_type key; the User_Controller constructor compares that session value against the required role using PHP's loose inequality operator, so type juggling can pass a check it should fail. Against the default CodeIgniter session store, which returns strings, the comparison behaves correctly and the bypass does not occur, which is why the assessed CVSS is 4.8 with high attack complexity and impact limited to low confidentiality and integrity. No public exploit identified at time of analysis.
Cross-site request forgery in InvoicePlane versions prior to 1.7.2 lets an attacker silently stop a victim's recurring invoices by luring an authenticated administrator into loading attacker-controlled content that auto-requests the state-changing GET endpoint /invoices/recurring/stop/{id}. Because the route performs a privileged action without CSRF token validation on a simple GET, the attacker needs only a known or brute-forceable recurring-invoice identifier and no user interaction beyond the admin having a live session. The impact is integrity-only and confined to interrupting recurring billing, which can cause financial loss for the organization; the vendor has confirmed the flaw (GHSA-qf9q-2hxm-4wh9) and fixed it in release 1.7.2. No public exploit code has been identified and the issue is not listed as actively exploited in CISA KEV, though the low attack complexity and zero-click nature of the request keep the practical risk moderate.
Unauthenticated log injection in InvoicePlane (all versions prior to 1.7.2) allows remote attackers to forge entries in the application's error log by supplying a crafted cron_key value containing CRLF characters to the Cron::recur() endpoint. Because the invalid key is reflected straight into log_message('error', ...) without neutralization, an attacker can insert arbitrary fake log lines, corrupting the audit trail and potentially misleading log-based monitoring or forensic analysis. There is no public exploit identified at time of analysis and the vulnerability is not confirmed actively exploited; impact is limited to log integrity (CVSS 5.3, C:N/I:L/A:N) with no data disclosure, code execution, or denial of service, though the EPSS signal is not available and the issue was addressed in the 1.7.2 release.
InvoicePlane releases prior to 1.7.2 store and serve image attachments (invoice, quote, and other attachment uploads) without stripping EXIF metadata, so any authenticated recipient with whom a picture is shared can recover embedded GPS coordinates, capture timestamps, camera/device identifiers, and similar details that the uploader never intended to disclose. The assessed vector requires an authenticated low-privileged user (PR:L) on the network to view the shared image, and exploitation is entirely contingent on the uploader having attached a photo that actually carries EXIF data - screenshots, re-encoded images, and scanned documents expose nothing, which keeps the practical impact low and conditional. Exploitation yields only whatever metadata happens to be present in the file, so this is a privacy leak rather than a code-execution or account-takeover flaw; no public exploit code has been identified and the issue is not listed on CISA KEV, though note that the 1.7.2 mitigation ships disabled by default and must be explicitly enabled to be effective.
Authenticated InvoicePlane administrators can store a crafted custom_field_table value that is later concatenated into SQL identifier positions when the custom-field edit form is opened, producing a second-order SQL injection in releases prior to 1.7.2. The flaw can expose arbitrary database schema data and cause application errors or denial of service, but it requires a high-privilege administrator account (PR:H), so it is a modest-priority issue that mainly affects malicious insiders or already-compromised admin sessions. Vendor-released patch: 1.7.2; no public exploit identified at time of analysis.
Stored XSS in InvoicePlane's Sumex invoice view enables authenticated users with invoice management privileges to inject malicious JavaScript that executes in other users' browsers, potentially compromising sessions and enabling data theft. Public exploit code exists for this vulnerability. Version 1.7.1 and later contain the fix.
InvoicePlane 1.7.0 and earlier contains a stored XSS vulnerability in the Invoice Groups "Identifier Format" field that authenticated users can exploit to inject malicious scripts executed when other users access the invoice list or dashboard. An attacker with invoice group management permissions can inject arbitrary JavaScript that runs in the context of other users' browsers, potentially leading to session hijacking or credential theft. A patch is available in version 1.7.1.
InvoicePlane 1.7.0 contains a stored XSS vulnerability in the Product Unit Name field that allows authenticated administrators to inject malicious scripts executed when other admins view affected invoices. Public exploit code exists for this vulnerability, though exploitation requires high-privilege administrator access and user interaction. Version 1.7.1 resolves the issue.
InvoicePlane 1.7.0 contains a stored XSS vulnerability in the Invoice Number field that allows authenticated administrators to inject malicious JavaScript executing in other administrators' browsers when viewing invoices or the dashboard. Public exploit code exists for this vulnerability, which has a CVSS score of 4.8 and can result in data theft or unauthorized actions within the application. A patch is available in version 1.7.1.
InvoicePlane 1.7.0 contains a stored XSS vulnerability in the Family Name field that executes malicious scripts in administrators' browsers when they access the product form. An authenticated administrator can inject payloads via the family dropdown to compromise other admin sessions. Public exploit code exists for this vulnerability, though a patch is available in version 1.7.1.
Stored XSS via SVG file upload in InvoicePlane 1.7.0 Login Logo functionality allows authenticated administrators to inject persistent malicious scripts, potentially compromising application integrity and enabling unauthorized data modification. Public exploit code exists for this vulnerability, which requires high-level privileges but can lead to persistent backdoors and full application compromise. InvoicePlane 1.7.1 addresses this issue.
Stored XSS in InvoicePlane 1.7.0's invoice editing function fails to sanitize the invoice_number parameter, allowing authenticated administrators to inject malicious scripts that persist in the application. Public exploit code exists for this vulnerability, enabling attackers with admin access to modify data, create backdoors, and compromise application integrity. Version 1.7.1 addresses this issue.
Stored XSS in InvoicePlane 1.7.0 via malicious SVG file upload in the Invoice Logo function allows authenticated administrators to inject persistent malicious scripts and compromise application integrity. Public exploit code exists for this vulnerability. Version 1.7.1 contains the patch.
Stored XSS in InvoicePlane 1.7.0's Edit Quotes function allows authenticated administrators to inject malicious scripts via the unvalidated quote_number parameter, enabling persistent code execution and data manipulation. Public exploit code exists for this vulnerability, which could lead to unauthorized modification of invoices, creation of backdoors, and complete compromise of application integrity. Version 1.7.1 addresses this flaw.
InvoicePlane through 1.6.3 allows authenticated users to upload PHP files as attachments that can be executed remotely. Low privileges sufficient with scope change. PoC available.
Directory traversal vulnerability in InvoicePlane through 1.6.3 allows unauthenticated attackers to read files from the server. The ability to read files and the file type depends on the web server and its configuration. [CVSS 5.3 MEDIUM]
An SQL injection vulnerability in InvoicePlane through 1.6.3 has been identified in "maxQuantity" and "minQuantity" parameters when generating a report. An authenticated attacker can exploit this issue via error-based SQL injection, allowing for the extraction of arbitrary data from the database. [CVSS 6.5 MEDIUM]
Authenticated users of InvoicePlane 1.6.1 can read invoices belonging to other users by supplying an arbitrary invoice identifier to the invoices/view handler, which returns invoice data without verifying ownership. The issue is a moderate-severity incorrect access control flaw (CVSS 4.3, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) that requires a valid low-privilege account and results only in confidentiality loss - no modification or denial of service. Publicly available exploit code exists, so the flaw is trivial to reproduce once credentials are held, though EPSS places it in the lower risk band (0.30%, 21st percentile) and there is no confirmed active exploitation; this is a genuine but moderate-priority issue rather than a top-tier emergency.
InvoicePlane (all versions tested as of December 2024) v.1.6.11 and before contains a remote code execution vulnerability in the upload_file method of the Upload controller. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
A vulnerability was found in InvoicePlane up to 1.6.1 and classified as problematic. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A vulnerability was found in InvoicePlane up to 1.6.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in InvoicePlane up to 1.6.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross Site Scripting (XSS) vulnerability in InvoicePlane 1.6 via filter_product input to file modal_product_lookups.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and file download. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
InvoicePlane 1.5.11 doesn't have any rate-limiting for password reset and the reset token is generated using a weak mechanism that is predictable. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In InvoicePlane 1.5.11, the upload feature discloses the full path of the file upload directory. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoice_password parameter, aka the "PDF password" field to the "Create Invoice" option. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An XSS issue was discovered in InvoicePlane 1.5.10 via the "Quote PDF Password(Optional)" field. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
InvoicePlane version 1.4.10 is vulnerable to a Stored Cross Site Scripting resulting in allowing an authenticated user to inject malicious client side script which will be executed in the browser of. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
InvoicePlane version 1.4.10 is vulnerable to a Arbitrary File Upload resulting in an authenticated user can upload a malicious file to the webserver. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Privilege destruction in InvoicePlane 1.7.2 allows an authenticated secondary administrator to demote the primary administrator account (user_id = 1) to a read-only Guest role by exploiting a missing object-level authorization check in the Users::form() endpoint. This locks the legitimate owner out of the instance. The vulnerability requires an attacker who already holds a secondary admin account (user_type = 1) and a deployment with more than one administrator; no public exploit code or active exploitation has been identified at time of analysis, and no vendor patch is currently available.
Account takeover of the InvoicePlane primary administrator (user_id=1) is possible for any authenticated secondary administrator (user_type=1, user_id != 1) on version 1.7.2 prior to commit 8616fa4. The attacker uses Users::form(), which performs no object-level authorization check on the primary admin's record, to overwrite the primary administrator's user_email value (it is not listed in PROTECTED_FIELDS), then drives the instance's public, logged-out password-recovery flow that resolves accounts by user_email to obtain the reset token and seize control of user_id=1. This is an alternate path around the earlier fix in PR #1638, which protected only Users::change_password(); no public exploit code was identified at time of analysis and there is no CISA KEV entry, but the vendor has published a GitHub Security Advisory (GHSA-77hm-22wp-96wp) and a patch commit.
Cross-site request forgery in InvoicePlane before 1.7.2 allows a remote, unauthenticated attacker to force deletion of invoice and invoice-tax records by inducing a logged-in administrator to load attacker-controlled content that invokes the Invoices::delete() or Invoices::delete_invoice_tax() routes. Those routes performed state-changing operations without requiring a POST method or validating a CSRF token, so the victim administrator's active session was sufficient to authorize the deletion (independent assessment: CVSS:3.1/AV:N/AC:L/PR:N/UI:R - integrity high, availability low, confidentiality none). No public exploit has been identified at time of analysis, and no confirmed active exploitation (CISA KEV) applies; despite the 7.5 base score, this is a moderate rather than high real-world priority because it requires administrator interaction and results only in removal of financial records, with the fix released in 1.7.2.
Local file inclusion in InvoicePlane before 1.7.2 allows an authenticated low-privileged user who can influence the e-invoice xml_id configuration to use path traversal sequences to include an existing .php file from the XMLconfigs helper directory. This is a moderate-priority, not urgent, finding: the advisory establishes local file inclusion, while full code execution would require a separate file-upload or file-write primitive, and no public exploit identified at time of analysis. The issue is fixed in version 1.7.2 via an allowlist on xml_id.
SQL injection in InvoicePlane's tax-rate settings allows an authenticated administrator to inject arbitrary SQL fragments into the ALTER TABLE statement that rebuilds the ip_tax_rates schema, letting them alter or drop required database columns in every release prior to 1.7.2. Because the malicious value is changed through the admin-only Settings page, exploitation requires high privileges (CVSS PR:H); the outcome is persistent schema corruption affecting financial data structures and potential loss of application availability, with integrity and availability impact rated high. No public exploit code has been identified at time of analysis, and the issue is resolved by upgrading to 1.7.2.
Remote code execution in InvoicePlane builds prior to 1.7.2-rc-1 allows an attacker who already holds InvoicePlane's administrator-controlled file-write capability to plant a malicious PHP file inside the PHP template directory that Mdl_templates automatically scans and trusts. That planted file can then be selected as public_invoice_template, and when any unauthenticated guest renders the corresponding public invoice, the guest View controller includes and executes it with web-server privileges - a CWE-98 PHP file-inclusion flaw with a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Exploitation is gated by the need for high-privilege file-write access (PR:H) even though the execution trigger is network-reachable and unauthenticated, and no public exploit code has been identified at time of analysis; the vendor fixes the issue in 1.7.2-rc-1 by replacing filesystem scanning with explicit allowlist constants.
Remote Code Execution in InvoicePlane self-hosted invoicing application through code injection. PoC and patch available.
Unauthenticated attackers can read arbitrary files from InvoicePlane servers through path traversal in the Guest controller's file retrieval function, potentially exposing database credentials and other sensitive configuration data. This vulnerability affects InvoicePlane versions up to 1.6.3 and has public exploit code available. Version 1.6.4 resolves the issue.
Stored cross-site scripting in InvoicePlane 1.7.2-beta-1 and earlier lets an authenticated administrator who can edit client records persist an attribute-breaking payload in the client_email field, which the invoice and quote mailer views then render unescaped inside a double-quoted to_email value attribute. When the mailer feature is configured for the affected client and a second authenticated administrator opens the related mailer page, the injected JavaScript runs in the InvoicePlane origin and can act with that victim's session. Exploitation requires two separate high-privilege admin accounts plus victim user interaction, which keeps this a genuine but low-priority issue; no public exploit code has been identified at time of analysis, and the flaw is fixed in version 1.7.2.
An insecure direct object reference in InvoicePlane's Users::change_password() endpoint (prior to 1.7.2) lets an authenticated secondary administrator replace the password of any other user account - most critically the primary administrator - without knowing or supplying the current password, resulting in full takeover of that account and its privileges. Exploitation requires an existing administrator-level session (CVSS PR:H) and a deployment with at least one other admin account to target, so this is a privilege-consolidation/lateral-movement flaw rather than an unauthenticated remote takeover; no public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited. Vendor-released patch: 1.7.2.
Cross-site request forgery in InvoicePlane versions prior to 1.7.2 lets an attacker force a logged-in administrator's browser to submit forged POST requests that permanently delete financial and configuration records - including payments, recurring invoices, client-user assignments, users, email templates, families, and import data. The destructive delete()/stop() methods omit the ensure_valid_post_request() CSRF token check that other parts of the application rely on, so although the routes accept only POST, they never validate the request's token; exploitation requires the victim administrator to visit attacker-controlled web content while holding a valid session (CVSS 3.1 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N). No public exploit code or confirmed active exploitation was identified at time of analysis, and the integrity impact is bounded to records the admin session could already delete - there is no data exfiltration, and deleted records may be recoverable from backups.
Authorization bypass in InvoicePlane versions prior to 1.7.2 lets unauthenticated remote attackers satisfy the application's primary role check when the instance is configured with a non-standard session backend that returns non-string scalar values for the session user_type key; the User_Controller constructor compares that session value against the required role using PHP's loose inequality operator, so type juggling can pass a check it should fail. Against the default CodeIgniter session store, which returns strings, the comparison behaves correctly and the bypass does not occur, which is why the assessed CVSS is 4.8 with high attack complexity and impact limited to low confidentiality and integrity. No public exploit identified at time of analysis.
Cross-site request forgery in InvoicePlane versions prior to 1.7.2 lets an attacker silently stop a victim's recurring invoices by luring an authenticated administrator into loading attacker-controlled content that auto-requests the state-changing GET endpoint /invoices/recurring/stop/{id}. Because the route performs a privileged action without CSRF token validation on a simple GET, the attacker needs only a known or brute-forceable recurring-invoice identifier and no user interaction beyond the admin having a live session. The impact is integrity-only and confined to interrupting recurring billing, which can cause financial loss for the organization; the vendor has confirmed the flaw (GHSA-qf9q-2hxm-4wh9) and fixed it in release 1.7.2. No public exploit code has been identified and the issue is not listed as actively exploited in CISA KEV, though the low attack complexity and zero-click nature of the request keep the practical risk moderate.
Unauthenticated log injection in InvoicePlane (all versions prior to 1.7.2) allows remote attackers to forge entries in the application's error log by supplying a crafted cron_key value containing CRLF characters to the Cron::recur() endpoint. Because the invalid key is reflected straight into log_message('error', ...) without neutralization, an attacker can insert arbitrary fake log lines, corrupting the audit trail and potentially misleading log-based monitoring or forensic analysis. There is no public exploit identified at time of analysis and the vulnerability is not confirmed actively exploited; impact is limited to log integrity (CVSS 5.3, C:N/I:L/A:N) with no data disclosure, code execution, or denial of service, though the EPSS signal is not available and the issue was addressed in the 1.7.2 release.
InvoicePlane releases prior to 1.7.2 store and serve image attachments (invoice, quote, and other attachment uploads) without stripping EXIF metadata, so any authenticated recipient with whom a picture is shared can recover embedded GPS coordinates, capture timestamps, camera/device identifiers, and similar details that the uploader never intended to disclose. The assessed vector requires an authenticated low-privileged user (PR:L) on the network to view the shared image, and exploitation is entirely contingent on the uploader having attached a photo that actually carries EXIF data - screenshots, re-encoded images, and scanned documents expose nothing, which keeps the practical impact low and conditional. Exploitation yields only whatever metadata happens to be present in the file, so this is a privacy leak rather than a code-execution or account-takeover flaw; no public exploit code has been identified and the issue is not listed on CISA KEV, though note that the 1.7.2 mitigation ships disabled by default and must be explicitly enabled to be effective.
Authenticated InvoicePlane administrators can store a crafted custom_field_table value that is later concatenated into SQL identifier positions when the custom-field edit form is opened, producing a second-order SQL injection in releases prior to 1.7.2. The flaw can expose arbitrary database schema data and cause application errors or denial of service, but it requires a high-privilege administrator account (PR:H), so it is a modest-priority issue that mainly affects malicious insiders or already-compromised admin sessions. Vendor-released patch: 1.7.2; no public exploit identified at time of analysis.
Stored XSS in InvoicePlane's Sumex invoice view enables authenticated users with invoice management privileges to inject malicious JavaScript that executes in other users' browsers, potentially compromising sessions and enabling data theft. Public exploit code exists for this vulnerability. Version 1.7.1 and later contain the fix.
InvoicePlane 1.7.0 and earlier contains a stored XSS vulnerability in the Invoice Groups "Identifier Format" field that authenticated users can exploit to inject malicious scripts executed when other users access the invoice list or dashboard. An attacker with invoice group management permissions can inject arbitrary JavaScript that runs in the context of other users' browsers, potentially leading to session hijacking or credential theft. A patch is available in version 1.7.1.
InvoicePlane 1.7.0 contains a stored XSS vulnerability in the Product Unit Name field that allows authenticated administrators to inject malicious scripts executed when other admins view affected invoices. Public exploit code exists for this vulnerability, though exploitation requires high-privilege administrator access and user interaction. Version 1.7.1 resolves the issue.
InvoicePlane 1.7.0 contains a stored XSS vulnerability in the Invoice Number field that allows authenticated administrators to inject malicious JavaScript executing in other administrators' browsers when viewing invoices or the dashboard. Public exploit code exists for this vulnerability, which has a CVSS score of 4.8 and can result in data theft or unauthorized actions within the application. A patch is available in version 1.7.1.
InvoicePlane 1.7.0 contains a stored XSS vulnerability in the Family Name field that executes malicious scripts in administrators' browsers when they access the product form. An authenticated administrator can inject payloads via the family dropdown to compromise other admin sessions. Public exploit code exists for this vulnerability, though a patch is available in version 1.7.1.
Stored XSS via SVG file upload in InvoicePlane 1.7.0 Login Logo functionality allows authenticated administrators to inject persistent malicious scripts, potentially compromising application integrity and enabling unauthorized data modification. Public exploit code exists for this vulnerability, which requires high-level privileges but can lead to persistent backdoors and full application compromise. InvoicePlane 1.7.1 addresses this issue.
Stored XSS in InvoicePlane 1.7.0's invoice editing function fails to sanitize the invoice_number parameter, allowing authenticated administrators to inject malicious scripts that persist in the application. Public exploit code exists for this vulnerability, enabling attackers with admin access to modify data, create backdoors, and compromise application integrity. Version 1.7.1 addresses this issue.
Stored XSS in InvoicePlane 1.7.0 via malicious SVG file upload in the Invoice Logo function allows authenticated administrators to inject persistent malicious scripts and compromise application integrity. Public exploit code exists for this vulnerability. Version 1.7.1 contains the patch.
Stored XSS in InvoicePlane 1.7.0's Edit Quotes function allows authenticated administrators to inject malicious scripts via the unvalidated quote_number parameter, enabling persistent code execution and data manipulation. Public exploit code exists for this vulnerability, which could lead to unauthorized modification of invoices, creation of backdoors, and complete compromise of application integrity. Version 1.7.1 addresses this flaw.
InvoicePlane through 1.6.3 allows authenticated users to upload PHP files as attachments that can be executed remotely. Low privileges sufficient with scope change. PoC available.
Directory traversal vulnerability in InvoicePlane through 1.6.3 allows unauthenticated attackers to read files from the server. The ability to read files and the file type depends on the web server and its configuration. [CVSS 5.3 MEDIUM]
An SQL injection vulnerability in InvoicePlane through 1.6.3 has been identified in "maxQuantity" and "minQuantity" parameters when generating a report. An authenticated attacker can exploit this issue via error-based SQL injection, allowing for the extraction of arbitrary data from the database. [CVSS 6.5 MEDIUM]
Authenticated users of InvoicePlane 1.6.1 can read invoices belonging to other users by supplying an arbitrary invoice identifier to the invoices/view handler, which returns invoice data without verifying ownership. The issue is a moderate-severity incorrect access control flaw (CVSS 4.3, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) that requires a valid low-privilege account and results only in confidentiality loss - no modification or denial of service. Publicly available exploit code exists, so the flaw is trivial to reproduce once credentials are held, though EPSS places it in the lower risk band (0.30%, 21st percentile) and there is no confirmed active exploitation; this is a genuine but moderate-priority issue rather than a top-tier emergency.
InvoicePlane (all versions tested as of December 2024) v.1.6.11 and before contains a remote code execution vulnerability in the upload_file method of the Upload controller. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
A vulnerability was found in InvoicePlane up to 1.6.1 and classified as problematic. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A vulnerability was found in InvoicePlane up to 1.6.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in InvoicePlane up to 1.6.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross Site Scripting (XSS) vulnerability in InvoicePlane 1.6 via filter_product input to file modal_product_lookups.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and file download. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
InvoicePlane 1.5.11 doesn't have any rate-limiting for password reset and the reset token is generated using a weak mechanism that is predictable. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In InvoicePlane 1.5.11, the upload feature discloses the full path of the file upload directory. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoice_password parameter, aka the "PDF password" field to the "Create Invoice" option. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An XSS issue was discovered in InvoicePlane 1.5.10 via the "Quote PDF Password(Optional)" field. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
InvoicePlane version 1.4.10 is vulnerable to a Stored Cross Site Scripting resulting in allowing an authenticated user to inject malicious client side script which will be executed in the browser of. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
InvoicePlane version 1.4.10 is vulnerable to a Arbitrary File Upload resulting in an authenticated user can upload a malicious file to the webserver. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.