agentprime: invoiceplaneEvery new CVE for invoiceplane.https://agentprime.io/CVE-2026-55561: InvoicePlane: Guest user IDOR in quote approval and rejectionhttps://agentprime.io/advisories/CVE-2026-55561/https://agentprime.io/advisories/CVE-2026-55561/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 22:33:47 GMTCVECVE-2026-100392: InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)https://agentprime.io/advisories/CVE-2026-100392/https://agentprime.io/advisories/CVE-2026-100392/CVSS 7.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 28 Sep 2026 20:16:19 GMTCVECVE-2026-100371: InvoicePlane: Incomplete Authorization Remediation in Users::form() Enables Primary Administrator Account Takeover via Email Reassignment and Password Recoveryhttps://agentprime.io/advisories/CVE-2026-100371/https://agentprime.io/advisories/CVE-2026-100371/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 28 Sep 2026 20:15:17 GMTCVECVE-2026-88003: InvoicePlane: Failure to Revoke Administrative Privileges After Role Downgradehttps://agentprime.io/advisories/CVE-2026-88003/https://agentprime.io/advisories/CVE-2026-88003/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 21:20:13 GMTCVECVE-2026-49850: InvoicePlane: Missing CSRF Protection on State-Changing delete Actionshttps://agentprime.io/advisories/CVE-2026-49850/https://agentprime.io/advisories/CVE-2026-49850/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 15:40:08 GMTCVECVE-2026-50547: InvoicePlane permits local file inclusion through the e-invoice XML configuration identifierhttps://agentprime.io/advisories/CVE-2026-50547/https://agentprime.io/advisories/CVE-2026-50547/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 15:38:31 GMTCVECVE-2026-33639: InvoicePlane permits DDL injection through tax_rate_decimal_placeshttps://agentprime.io/advisories/CVE-2026-33639/https://agentprime.io/advisories/CVE-2026-33639/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 15:36:52 GMTCVECVE-2026-39353: InvoicePlane: Remote Code Execution via Writable Templates Directoryhttps://agentprime.io/advisories/CVE-2026-39353/https://agentprime.io/advisories/CVE-2026-39353/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 15:30:58 GMTCVEcriticalCVE-2026-85293: InvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer Formshttps://agentprime.io/advisories/CVE-2026-85293/https://agentprime.io/advisories/CVE-2026-85293/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 15:29:30 GMTCVECVE-2026-85291: InvoicePlane IDOR: Horizontal Privilege Escalation via Password Change Without Authorization Checkhttps://agentprime.io/advisories/CVE-2026-85291/https://agentprime.io/advisories/CVE-2026-85291/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 15:28:33 GMTCVECVE-2026-85289: InvoicePlane: Missing CSRF Token Validation on Multiple Delete Endpointshttps://agentprime.io/advisories/CVE-2026-85289/https://agentprime.io/advisories/CVE-2026-85289/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 15:26:22 GMTCVECVE-2026-85292: InvoicePlane: Loose Type Comparison in Core Authentication Check (Defense-in-Depth)https://agentprime.io/advisories/CVE-2026-85292/https://agentprime.io/advisories/CVE-2026-85292/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 15:25:26 GMTCVECVE-2026-85274: InvoicePlane: Recurring Invoice State Change via GET Request Without CSRF Protectionhttps://agentprime.io/advisories/CVE-2026-85274/https://agentprime.io/advisories/CVE-2026-85274/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 15:24:28 GMTCVECVE-2026-85290: InvoicePlane: Log Injection via Unsanitized User Input in Cron Key Error Logginghttps://agentprime.io/advisories/CVE-2026-85290/https://agentprime.io/advisories/CVE-2026-85290/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 15:23:20 GMTCVECVE-2026-39372: InvoicePlane: Sensitive Information Disclosure via Unstripped EXIF Metadata in Attachmentshttps://agentprime.io/advisories/CVE-2026-39372/https://agentprime.io/advisories/CVE-2026-39372/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 15:21:53 GMTCVECVE-2026-54790: InvoicePlane: Second-order SQL injection through the unvalidated custom_field_table field in the Custom Fields modulehttps://agentprime.io/advisories/CVE-2026-54790/https://agentprime.io/advisories/CVE-2026-54790/CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 15:19:21 GMTCVECVE-2026-26281: InvoicePlane has Stored Cross-Site Scripting (XSS) Issue in Sumex Invoice Viewhttps://agentprime.io/advisories/CVE-2026-26281/https://agentprime.io/advisories/CVE-2026-26281/CVSS 4.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 18 Feb 2026 23:03:08 GMTCVECVE-2026-26270: InvoicePlane has Stored Cross-Site Scripting Issue in Identifier Formattinghttps://agentprime.io/advisories/CVE-2026-26270/https://agentprime.io/advisories/CVE-2026-26270/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 18 Feb 2026 23:01:41 GMTCVECVE-2026-25596: InvoicePlane has Stored XSS via Product Unit Name in Invoice Item Listhttps://agentprime.io/advisories/CVE-2026-25596/https://agentprime.io/advisories/CVE-2026-25596/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 18 Feb 2026 22:59:44 GMTCVECVE-2026-25595: InvoicePlane has Stored XSS via Invoice Number in Invoice View and Dashboardhttps://agentprime.io/advisories/CVE-2026-25595/https://agentprime.io/advisories/CVE-2026-25595/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 18 Feb 2026 22:52:27 GMTCVECVE-2026-25594: InvoicePlane has Stored XSS via Family Name in Product Formhttps://agentprime.io/advisories/CVE-2026-25594/https://agentprime.io/advisories/CVE-2026-25594/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 18 Feb 2026 22:50:45 GMTCVECVE-2026-25548: InvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoninghttps://agentprime.io/advisories/CVE-2026-25548/https://agentprime.io/advisories/CVE-2026-25548/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 18 Feb 2026 22:49:15 GMTCVEcriticalCVE-2026-24745: InvoicePlane has a Stored Cross-Site Scripting (XSS) issuehttps://agentprime.io/advisories/CVE-2026-24745/https://agentprime.io/advisories/CVE-2026-24745/CVSS 5.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 18 Feb 2026 22:47:19 GMTCVECVE-2026-24744: InvoicePlane has a Stored Cross-Site Scripting (XSS) issuehttps://agentprime.io/advisories/CVE-2026-24744/https://agentprime.io/advisories/CVE-2026-24744/CVSS 5.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 18 Feb 2026 21:01:27 GMTCVECVE-2026-24743: InvoicePlane has a Stored Cross-Site Scripting (XSS) issuehttps://agentprime.io/advisories/CVE-2026-24743/https://agentprime.io/advisories/CVE-2026-24743/CVSS 5.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 18 Feb 2026 20:59:16 GMTCVECVE-2026-24746: InvoicePlane has a Stored Cross-Site Scripting (XSS) issuehttps://agentprime.io/advisories/CVE-2026-24746/https://agentprime.io/advisories/CVE-2026-24746/CVSS 5.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 18 Feb 2026 20:51:20 GMTCVECVE-2026-23491: InvoicePlane has Unauthenticated Path Traversal in Guest Controllerhttps://agentprime.io/advisories/CVE-2026-23491/https://agentprime.io/advisories/CVE-2026-23491/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 18 Feb 2026 19:52:26 GMTCVEcriticalCVE-2024-12667: InvoicePlane view session expirationhttps://agentprime.io/advisories/CVE-2024-12667/https://agentprime.io/advisories/CVE-2024-12667/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 16 Dec 2024 20:00:14 GMTCVECVE-2024-12478: InvoicePlane 1 upload_file unrestricted uploadhttps://agentprime.io/advisories/CVE-2024-12478/https://agentprime.io/advisories/CVE-2024-12478/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 16 Dec 2024 10:31:04 GMTCVECVE-2024-12362: InvoicePlane invoices.php download path traversalhttps://agentprime.io/advisories/CVE-2024-12362/https://agentprime.io/advisories/CVE-2024-12362/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 16 Dec 2024 10:00:18 GMTCVE