# InvoicePlane.

Every CVE that names InvoicePlane among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [InvoicePlane: Guest user IDOR in quote approval and rejection](https://agentprime.io/advisories/CVE-2026-55561.md)
  `CVE-2026-55561` · CVE record: InvoicePlane InvoicePlane · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [InvoicePlane: Primary Administrator Privilege Downgrade via \`Users::form()\` (Missing Object-Level Authorization)](https://agentprime.io/advisories/CVE-2026-100392.md)
  `CVE-2026-100392` · CVE record: InvoicePlane InvoicePlane · CVSS 7.0 High · Not analysed yet · Published 28 Sept 2026 · Tags: Broken access control
- [InvoicePlane: Incomplete Authorization Remediation in Users::form() Enables Primary Administrator Account Takeover via Email Reassignment and Password Recovery](https://agentprime.io/advisories/CVE-2026-100371.md)
  `CVE-2026-100371` · CVE record: InvoicePlane InvoicePlane · CVSS 8.7 High · Not analysed yet · Published 28 Sept 2026 · Tags: Broken access control
- [InvoicePlane: Failure to Revoke Administrative Privileges After Role Downgrade](https://agentprime.io/advisories/CVE-2026-88003.md)
  `CVE-2026-88003` · CVE record: InvoicePlane InvoicePlane · CVSS 7.5 High · Not analysed yet · Published 25 Sept 2026 · Tags: Broken access control
- [InvoicePlane: Missing CSRF Protection on State-Changing delete Actions](https://agentprime.io/advisories/CVE-2026-49850.md)
  `CVE-2026-49850` · CVE record: InvoicePlane InvoicePlane · CVSS 7.5 High · Not analysed yet · Published 25 Sept 2026 · Tags: Path traversal, File inclusion
- [InvoicePlane permits local file inclusion through the e-invoice XML configuration identifier](https://agentprime.io/advisories/CVE-2026-50547.md)
  `CVE-2026-50547` · CVE record: InvoicePlane InvoicePlane · CVSS 7.5 High · Not analysed yet · Published 25 Sept 2026 · Tags: Path traversal, File inclusion
- [InvoicePlane permits DDL injection through tax_rate_decimal_places](https://agentprime.io/advisories/CVE-2026-33639.md)
  `CVE-2026-33639` · CVE record: InvoicePlane InvoicePlane · CVSS 7.2 High · Not analysed yet · Published 25 Sept 2026 · Tags: SQL injection
- [InvoicePlane: Remote Code Execution via Writable Templates Directory](https://agentprime.io/advisories/CVE-2026-39353.md)
  `CVE-2026-39353` · CVE record: InvoicePlane InvoicePlane · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: File inclusion, Broken access control, CWE-693
- [InvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer Forms](https://agentprime.io/advisories/CVE-2026-85293.md)
  `CVE-2026-85293` · CVE record: InvoicePlane InvoicePlane · CVSS 4.8 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [InvoicePlane IDOR: Horizontal Privilege Escalation via Password Change Without Authorization Check](https://agentprime.io/advisories/CVE-2026-85291.md)
  `CVE-2026-85291` · CVE record: InvoicePlane InvoicePlane · CVSS 6.5 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Broken access control
- [InvoicePlane: Missing CSRF Token Validation on Multiple Delete Endpoints](https://agentprime.io/advisories/CVE-2026-85289.md)
  `CVE-2026-85289` · CVE record: InvoicePlane InvoicePlane · CVSS 6.5 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site request forgery (CSRF)
- [InvoicePlane: Loose Type Comparison in Core Authentication Check (Defense-in-Depth)](https://agentprime.io/advisories/CVE-2026-85292.md)
  `CVE-2026-85292` · CVE record: InvoicePlane InvoicePlane · CVSS 4.8 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: CWE-697
- [InvoicePlane: Recurring Invoice State Change via GET Request Without CSRF Protection](https://agentprime.io/advisories/CVE-2026-85274.md)
  `CVE-2026-85274` · CVE record: InvoicePlane InvoicePlane · CVSS 6.5 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site request forgery (CSRF)
- [InvoicePlane: Log Injection via Unsanitized User Input in Cron Key Error Logging](https://agentprime.io/advisories/CVE-2026-85290.md)
  `CVE-2026-85290` · CVE record: InvoicePlane InvoicePlane · CVSS 5.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Other injection
- [InvoicePlane: Sensitive Information Disclosure via Unstripped EXIF Metadata in Attachments](https://agentprime.io/advisories/CVE-2026-39372.md)
  `CVE-2026-39372` · CVE record: InvoicePlane InvoicePlane · CVSS 4.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Information disclosure
- [InvoicePlane: Second-order SQL injection through the unvalidated custom_field_table field in the Custom Fields module](https://agentprime.io/advisories/CVE-2026-54790.md)
  `CVE-2026-54790` · CVE record: InvoicePlane InvoicePlane · CVSS 6.0 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: SQL injection
- [InvoicePlane has Stored Cross-Site Scripting (XSS) Issue in Sumex Invoice View](https://agentprime.io/advisories/CVE-2026-26281.md)
  `CVE-2026-26281` · CVE record: InvoicePlane InvoicePlane · CVSS 4.4 Medium · Not analysed yet · Published 18 Feb 2026 · Tags: Cross-site scripting (XSS)
- [InvoicePlane has Stored Cross-Site Scripting Issue in Identifier Formatting](https://agentprime.io/advisories/CVE-2026-26270.md)
  `CVE-2026-26270` · CVE record: InvoicePlane InvoicePlane · CVSS 5.4 Medium · Not analysed yet · Published 18 Feb 2026 · Tags: Cross-site scripting (XSS)
- [InvoicePlane has Stored XSS via Product Unit Name in Invoice Item List](https://agentprime.io/advisories/CVE-2026-25596.md)
  `CVE-2026-25596` · CVE record: InvoicePlane InvoicePlane · CVSS 4.8 Medium · Not analysed yet · Published 18 Feb 2026 · Tags: Cross-site scripting (XSS)
- [InvoicePlane has Stored XSS via Invoice Number in Invoice View and Dashboard](https://agentprime.io/advisories/CVE-2026-25595.md)
  `CVE-2026-25595` · CVE record: InvoicePlane InvoicePlane · CVSS 4.8 Medium · Not analysed yet · Published 18 Feb 2026 · Tags: Cross-site scripting (XSS)
- [InvoicePlane has Stored XSS via Family Name in Product Form](https://agentprime.io/advisories/CVE-2026-25594.md)
  `CVE-2026-25594` · CVE record: InvoicePlane InvoicePlane · CVSS 4.8 Medium · Not analysed yet · Published 18 Feb 2026 · Tags: Cross-site scripting (XSS)
- [InvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoning](https://agentprime.io/advisories/CVE-2026-25548.md)
  `CVE-2026-25548` · CVE record: InvoicePlane InvoicePlane · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Feb 2026 · Tags: Code injection, File inclusion, Other injection
- [InvoicePlane has a Stored Cross-Site Scripting (XSS) issue](https://agentprime.io/advisories/CVE-2026-24745.md)
  `CVE-2026-24745` · CVE record: InvoicePlane InvoicePlane · CVSS 5.7 Medium · Not analysed yet · Published 18 Feb 2026 · Tags: Cross-site scripting (XSS)
- [InvoicePlane has a Stored Cross-Site Scripting (XSS) issue](https://agentprime.io/advisories/CVE-2026-24744.md)
  `CVE-2026-24744` · CVE record: InvoicePlane InvoicePlane · CVSS 5.7 Medium · Not analysed yet · Published 18 Feb 2026 · Tags: Cross-site scripting (XSS)
- [InvoicePlane has a Stored Cross-Site Scripting (XSS) issue](https://agentprime.io/advisories/CVE-2026-24743.md)
  `CVE-2026-24743` · CVE record: InvoicePlane InvoicePlane · CVSS 5.7 Medium · Not analysed yet · Published 18 Feb 2026 · Tags: Cross-site scripting (XSS)
- [InvoicePlane has a Stored Cross-Site Scripting (XSS) issue](https://agentprime.io/advisories/CVE-2026-24746.md)
  `CVE-2026-24746` · CVE record: InvoicePlane InvoicePlane · CVSS 5.7 Medium · Not analysed yet · Published 18 Feb 2026 · Tags: Cross-site scripting (XSS)
- [InvoicePlane has Unauthenticated Path Traversal in Guest Controller](https://agentprime.io/advisories/CVE-2026-23491.md)
  `CVE-2026-23491` · CVE record: InvoicePlane InvoicePlane · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Feb 2026 · Tags: Path traversal
- [InvoicePlane view session expiration](https://agentprime.io/advisories/CVE-2024-12667.md)
  `CVE-2024-12667` · CVE record: InvoicePlane · CVSS 6.3 Medium · Not analysed yet · Published 16 Dec 2024 · Tags: Authentication bypass
- [InvoicePlane 1 upload_file unrestricted upload](https://agentprime.io/advisories/CVE-2024-12478.md)
  `CVE-2024-12478` · CVE record: InvoicePlane · CVSS 5.3 Medium · Not analysed yet · Published 16 Dec 2024 · Tags: Broken access control, Unrestricted file upload
- [InvoicePlane invoices.php download path traversal](https://agentprime.io/advisories/CVE-2024-12362.md)
  `CVE-2024-12362` · CVE record: InvoicePlane · CVSS 5.3 Medium · Not analysed yet · Published 16 Dec 2024 · Tags: Path traversal

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=invoiceplane>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/invoiceplane/>. Everything for agents: <https://agentprime.io/llms.txt>.