← Back

CVE-2026-26281

nvd nist
Published: Feb 18, 2026Modified: Jun 17, 2026

JSON object

Loading...
4.4
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Exploitability: 1.3 / Impact: 2.7
Source: security-advisories@github.com (Secondary)

Description

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A stored cross-site scripting (XSS) vulnerability in the Sumex invoice view allows an authenticated user with client and invoice management privileges to execute arbitrary JavaScript in the browser of any user viewing the invoice. This can lead to session hijacking, data theft, or other malicious actions on behalf of the victim user. Version 1.7.1 patches the issue.

Affected (1)

Invoiceplane
1 product
Invoiceplane
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Invoiceplane
Version 1.7.0

Related CWEs

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
ExploitVendor Advisory

Timeline

No history available yet.