Skip to content
Noroxi

InvoicePlane records

29 published records for vendor invoiceplane.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
13.8%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 18
  3. 19
  4. 21
  5. 23
  6. 24
  7. 25
  8. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

29 records
  • CVE-2024-56975
    39Monitor

    InvoicePlane (all versions tested as of December 2024) v.1.6.11 and before contains a remote code execution vulnerability in the upload_file

    CriticalCVSS 9.8No exploitEPSS 1%

    invoiceplane · invoiceplaneMar 28, 2025

  • CVE-2025-67084
    39Monitor

    File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which

    CriticalCVSS 9.9No exploitEPSS 0%

    invoiceplane · invoiceplaneJan 15, 2026

  • CVE-2026-23491
    38Monitor

    InvoicePlane has Unauthenticated Path Traversal in Guest Controller

    CriticalCVSS 9.3Proof of conceptEPSS 4%

    invoiceplane · invoiceplaneFeb 18, 2026

  • CVE-2026-25548
    36Monitor

    InvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoning

    CriticalCVSS 9.1Proof of conceptEPSS 1%

    invoiceplane · invoiceplaneFeb 18, 2026

  • CVE-2017-1000238
    35Monitor

    InvoicePlane version 1.4.10 is vulnerable to a Arbitrary File Upload resulting in an authenticated user can upload a malicious file to the w

    HighCVSS 8.8No exploitEPSS 1%

    invoiceplane · invoiceplaneNov 16, 2017

  • CVE-2021-29024
    30Monitor

    In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and file download.

    HighCVSS 7.5No exploitEPSS 2%

    invoiceplane · invoiceplaneMay 17, 2021

  • CVE-2026-24746
    30Monitor

    InvoicePlane has a Stored Cross-Site Scripting (XSS) issue

    HighCVSS 7.5No exploitEPSS 0%

    invoiceplane · invoiceplaneFeb 18, 2026

  • CVE-2026-24744
    30Monitor

    InvoicePlane has a Stored Cross-Site Scripting (XSS) issue

    HighCVSS 7.5No exploitEPSS 0%

    invoiceplane · invoiceplaneFeb 18, 2026

  • CVE-2026-24745
    30Monitor

    InvoicePlane has a Stored Cross-Site Scripting (XSS) issue

    HighCVSS 7.5No exploitEPSS 0%

    invoiceplane · invoiceplaneFeb 18, 2026

  • CVE-2026-24743
    30Monitor

    InvoicePlane has a Stored Cross-Site Scripting (XSS) issue

    HighCVSS 7.5No exploitEPSS 0%

    invoiceplane · invoiceplaneFeb 18, 2026

  • CVE-2025-67082
    26Monitor

    An SQL injection vulnerability in InvoicePlane through 1.6.3 has been identified in "maxQuantity" and "minQuantity" parameters when generati

    MediumCVSS 6.5No exploitEPSS 0%

    invoiceplane · invoiceplaneJan 15, 2026

  • CVE-2024-12667
    25Monitor

    InvoicePlane view session expiration

    MediumCVSS 6.3No exploitEPSS 1%

    invoiceplane · invoiceplaneDec 16, 2024

  • CVE-2017-18217
    24Monitor

    An issue was discovered in InvoicePlane before 1.5.5.

    MediumCVSS 6.1No exploitEPSS 1%

    invoiceplane · invoiceplaneMar 5, 2018

  • CVE-2017-1000508
    24Monitor

    Invoice Plane version 1.5.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in Client's details that can result in execution

    MediumCVSS 6.1No exploitEPSS 1%

    invoiceplane · invoiceplaneFeb 9, 2018

  • CVE-2018-12255
    24Monitor

    An XSS issue was discovered in InvoicePlane 1.5.10 via the "Quote PDF Password(Optional)" field.

    MediumCVSS 6.1No exploitEPSS 1%

    invoiceplane · invoiceplaneJul 3, 2018

  • CVE-2023-23011
    24Monitor

    Cross Site Scripting (XSS) vulnerability in InvoicePlane 1.6 via filter_product input to file modal_product_lookups.php.

    MediumCVSS 6.1No exploitEPSS 1%

    invoiceplane · invoiceplaneFeb 7, 2023

  • CVE-2021-29023
    21Monitor

    InvoicePlane 1.5.11 doesn't have any rate-limiting for password reset and the reset token is generated using a weak mechanism that is predic

    MediumCVSS 5.3No exploitEPSS 1%

    invoiceplane · invoiceplaneMay 17, 2021

  • CVE-2021-29022
    21Monitor

    In InvoicePlane 1.5.11, the upload feature discloses the full path of the file upload directory.

    MediumCVSS 5.3No exploitEPSS 1%

    invoiceplane · invoiceplaneMay 10, 2021

  • CVE-2025-67083
    21Monitor

    Directory traversal vulnerability in InvoicePlane through 1.6.3 allows unauthenticated attackers to read files from the server.

    MediumCVSS 5.3No exploitEPSS 1%

    invoiceplane · invoiceplaneJan 15, 2026

  • CVE-2019-7223
    21Monitor

    InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoice_password parameter, aka the "PDF password" field to the "Create

    MediumCVSS 5.4No exploitEPSS 1%

    invoiceplane · invoiceplaneMar 21, 2019

  • CVE-2024-12478
    21Monitor

    InvoicePlane 1 upload_file unrestricted upload

    MediumCVSS 5.3No exploitEPSS 1%

    invoiceplane · invoiceplaneDec 16, 2024

  • CVE-2024-12362
    21Monitor

    InvoicePlane invoices.php download path traversal

    MediumCVSS 5.3No exploitEPSS 1%

    invoiceplane · invoiceplaneDec 16, 2024

  • CVE-2017-1000239
    21Monitor

    InvoicePlane version 1.4.10 is vulnerable to a Stored Cross Site Scripting resulting in allowing an authenticated user to inject malicious c

    MediumCVSS 5.4No exploitEPSS 0%

    invoiceplane · invoiceplaneNov 16, 2017

  • CVE-2026-26270
    21Monitor

    InvoicePlane has Stored Cross-Site Scripting Issue in Identifier Formatting

    MediumCVSS 5.4No exploitEPSS 0%

    invoiceplane · invoiceplaneFeb 18, 2026

  • CVE-2026-25594
    19Monitor

    InvoicePlane has Stored XSS via Family Name in Product Form

    MediumCVSS 4.8Proof of conceptEPSS 0%

    invoiceplane · invoiceplaneFeb 18, 2026