Invoiceplane

Invoiceplane

44 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
9.8

CVE-2024-56975

  • EPSS 0.63%
  • Veröffentlicht 28.03.2025 00:00:00
  • Zuletzt bearbeitet 14.04.2025 16:50:35

InvoicePlane (all versions tested as of December 2024) v.1.6.11 and before contains a remote code execution vulnerability in the upload_file method of the Upload controller.

5.9

CVE-2024-12667

  • EPSS 0.52%
  • Veröffentlicht 16.12.2024 20:15:09
  • Zuletzt bearbeitet 19.12.2024 15:10:22

A vulnerability was found in InvoicePlane up to 1.6.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /invoices/view. The manipulation leads to session expiration. The attack may be launched remotely. T...

8.8

CVE-2024-12478

  • EPSS 0.54%
  • Veröffentlicht 16.12.2024 11:15:04
  • Zuletzt bearbeitet 15.10.2025 17:46:52

A vulnerability was found in InvoicePlane up to 1.6.1. It has been declared as critical. This vulnerability affects the function upload_file of the file /index.php/upload/upload_file/1/1. The manipulation of the argument file leads to unrestricted up...

5.3

CVE-2024-12362

  • EPSS 0.54%
  • Veröffentlicht 16.12.2024 10:15:05
  • Zuletzt bearbeitet 15.10.2025 17:42:53

A vulnerability was found in InvoicePlane up to 1.6.1. It has been classified as problematic. This affects the function download of the file invoices.php. The manipulation of the argument invoice leads to path traversal. It is possible to initiate th...

6.1

CVE-2023-23011

Exploit
  • EPSS 0.53%
  • Veröffentlicht 07.02.2023 23:15:09
  • Zuletzt bearbeitet 25.03.2025 15:15:18

Cross Site Scripting (XSS) vulnerability in InvoicePlane 1.6 via filter_product input to file modal_product_lookups.php.

7.5

CVE-2021-29024

Exploit
  • EPSS 1.63%
  • Veröffentlicht 17.05.2021 19:15:07
  • Zuletzt bearbeitet 29.07.2026 17:16:48

In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and file download. Allowing an attacker to directory traversal and download files suppose to be private without authentication.

5.3

CVE-2021-29023

Exploit
  • EPSS 1.14%
  • Veröffentlicht 17.05.2021 19:15:07
  • Zuletzt bearbeitet 29.07.2026 17:16:48

InvoicePlane 1.5.11 doesn't have any rate-limiting for password reset and the reset token is generated using a weak mechanism that is predictable.

5.3

CVE-2021-29022

Exploit
  • EPSS 1.07%
  • Veröffentlicht 10.05.2021 19:15:08
  • Zuletzt bearbeitet 29.07.2026 17:16:47

In InvoicePlane 1.5.11, the upload feature discloses the full path of the file upload directory.

5.4

CVE-2019-7223

Exploit
  • EPSS 0.67%
  • Veröffentlicht 21.03.2019 16:01:11
  • Zuletzt bearbeitet 21.11.2024 04:47:47

InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoice_password parameter, aka the "PDF password" field to the "Create Invoice" option. The XSS payload is rendered at an index.php/invoices/view/## URI. NOTE: this is different fr...

6.1

CVE-2018-12255

Exploit
  • EPSS 0.72%
  • Veröffentlicht 03.07.2018 12:29:00
  • Zuletzt bearbeitet 21.11.2024 03:44:52

An XSS issue was discovered in InvoicePlane 1.5.10 via the "Quote PDF Password(Optional)" field.