Invoiceplane

invoiceplane

29 CVEs • 1 product

Products (1)

Click to collapse

Toggle

CVEs (29)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-29024 1Invoiceplane 1Invoiceplane Jun 17, 2026 May 17, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and file download. Allowing an attacker to directory traversal and download files suppose to be private without authentication.
CVE-2021-29023 1Invoiceplane 1Invoiceplane Jun 17, 2026 May 17, 2021 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 InvoicePlane 1.5.11 doesn't have any rate-limiting for password reset and the reset token is generated using a weak mechanism that is predictable.
CVE-2021-29022 1Invoiceplane 1Invoiceplane Jun 17, 2026 May 10, 2021 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 In InvoicePlane 1.5.11, the upload feature discloses the full path of the file upload directory.
CVE-2019-7223 1Invoiceplane 1Invoiceplane Jun 17, 2026 Mar 21, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoice_password parameter, aka the "PDF password" field to the "Create Invoice" option. The XSS payload is rendered at an index.php/invoices/view/## U...Show more InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoice_password parameter, aka the "PDF password" field to the "Create Invoice" option. The XSS payload is rendered at an index.php/invoices/view/## URI. NOTE: this is different from CVE-2018-12255.Show less
CVE-2018-12255 1Invoiceplane 1Invoiceplane Nov 21, 2024 Jul 3, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An XSS issue was discovered in InvoicePlane 1.5.10 via the "Quote PDF Password(Optional)" field.
CVE-2017-18217 1Invoiceplane 1Invoiceplane Nov 21, 2024 Mar 5, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in InvoicePlane before 1.5.5. It was observed that the Email address and Web address parameters are vulnerable to Cross Site Scripting, related to application/modules/clients/views/view.php, appli...Show more An issue was discovered in InvoicePlane before 1.5.5. It was observed that the Email address and Web address parameters are vulnerable to Cross Site Scripting, related to application/modules/clients/views/view.php, application/modules/invoices/views/view.php, and application/modules/quotes/views/view.php.Show less
CVE-2017-1000508 1Invoiceplane 1Invoiceplane Nov 21, 2024 Feb 9, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Invoice Plane version 1.5.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in Client's details that can result in execution of javascript code . This vulnerability appears to have been fixed in 1.5.5 and...Show more Invoice Plane version 1.5.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in Client's details that can result in execution of javascript code . This vulnerability appears to have been fixed in 1.5.5 and later.Show less
CVE-2017-1000239 1Invoiceplane 1Invoiceplane May 13, 2026 Nov 17, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 InvoicePlane version 1.4.10 is vulnerable to a Stored Cross Site Scripting resulting in allowing an authenticated user to inject malicious client side script which will be executed in the browser of users if they visit t...Show more InvoicePlane version 1.4.10 is vulnerable to a Stored Cross Site Scripting resulting in allowing an authenticated user to inject malicious client side script which will be executed in the browser of users if they visit the manipulated site.Show less
CVE-2017-1000238 1Invoiceplane 1Invoiceplane May 13, 2026 Nov 17, 2017 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 InvoicePlane version 1.4.10 is vulnerable to a Arbitrary File Upload resulting in an authenticated user can upload a malicious file to the webserver. It is possible for an attacker to upload a script which is able to com...Show more InvoicePlane version 1.4.10 is vulnerable to a Arbitrary File Upload resulting in an authenticated user can upload a malicious file to the webserver. It is possible for an attacker to upload a script which is able to compromise the webserver.Show less