InvoicePlane.

InvoicePlane: Guest user IDOR in quote approval and rejection

• InvoicePlane
• Broken access control

InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)

• InvoicePlane
• Broken access control

InvoicePlane: Incomplete Authorization Remediation in Users::form() Enables Primary Administrator Account Takeover via Email Reassignment and Password Recovery

• InvoicePlane
• Broken access control

InvoicePlane: Failure to Revoke Administrative Privileges After Role Downgrade

• InvoicePlane
• Broken access control

InvoicePlane: Missing CSRF Protection on State-Changing delete Actions

• InvoicePlane
• Path traversal
• File inclusion

InvoicePlane permits local file inclusion through the e-invoice XML configuration identifier

• InvoicePlane
• Path traversal
• File inclusion

InvoicePlane permits DDL injection through tax_rate_decimal_places

• InvoicePlane
• SQL injection

InvoicePlane: Remote Code Execution via Writable Templates Directory

• InvoicePlane
• File inclusion
• Broken access control

InvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer Forms

• InvoicePlane
• Cross-site scripting (XSS)

InvoicePlane IDOR: Horizontal Privilege Escalation via Password Change Without Authorization Check

• InvoicePlane
• Broken access control

InvoicePlane: Missing CSRF Token Validation on Multiple Delete Endpoints

• InvoicePlane
• Cross-site request forgery (CSRF)

InvoicePlane: Loose Type Comparison in Core Authentication Check (Defense-in-Depth)

• InvoicePlane
• CWE-697

InvoicePlane: Recurring Invoice State Change via GET Request Without CSRF Protection

• InvoicePlane
• Cross-site request forgery (CSRF)

InvoicePlane: Log Injection via Unsanitized User Input in Cron Key Error Logging

• InvoicePlane
• Other injection

InvoicePlane: Sensitive Information Disclosure via Unstripped EXIF Metadata in Attachments

• InvoicePlane
• Information disclosure

InvoicePlane: Second-order SQL injection through the unvalidated custom_field_table field in the Custom Fields module

• InvoicePlane
• SQL injection

InvoicePlane has Stored Cross-Site Scripting (XSS) Issue in Sumex Invoice View

• InvoicePlane
• Cross-site scripting (XSS)

InvoicePlane has Stored Cross-Site Scripting Issue in Identifier Formatting

• InvoicePlane
• Cross-site scripting (XSS)

InvoicePlane has Stored XSS via Product Unit Name in Invoice Item List

• InvoicePlane
• Cross-site scripting (XSS)

InvoicePlane has Stored XSS via Invoice Number in Invoice View and Dashboard

• InvoicePlane
• Cross-site scripting (XSS)

InvoicePlane has Stored XSS via Family Name in Product Form

• InvoicePlane
• Cross-site scripting (XSS)

InvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoning

• InvoicePlane
• Code injection
• File inclusion

InvoicePlane has a Stored Cross-Site Scripting (XSS) issue

• InvoicePlane
• Cross-site scripting (XSS)

InvoicePlane has a Stored Cross-Site Scripting (XSS) issue

• InvoicePlane
• Cross-site scripting (XSS)

InvoicePlane has a Stored Cross-Site Scripting (XSS) issue

• InvoicePlane
• Cross-site scripting (XSS)

InvoicePlane has a Stored Cross-Site Scripting (XSS) issue

• InvoicePlane
• Cross-site scripting (XSS)

InvoicePlane has Unauthenticated Path Traversal in Guest Controller

• InvoicePlane
• Path traversal

InvoicePlane view session expiration

• InvoicePlane
• Authentication bypass

InvoicePlane 1 upload_file unrestricted upload

• InvoicePlane
• Broken access control
• Unrestricted file upload

InvoicePlane invoices.php download path traversal

• InvoicePlane
• Path traversal