agentprime: invoiceshelfEvery new CVE for invoiceshelf.https://agentprime.io/CVE-2026-122158: InvoiceShelf MemberService.php create access controlhttps://agentprime.io/advisories/CVE-2026-122158/https://agentprime.io/advisories/CVE-2026-122158/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 02:00:29 GMTCVECVE-2026-55382: InvoiceShelf: Cross-company read/modify/delete of notes via missing company scope in NotePolicy (BOLA/IDOR)https://agentprime.io/advisories/CVE-2026-55382/https://agentprime.io/advisories/CVE-2026-55382/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 19:27:00 GMTCVECVE-2026-55385: InvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configurationhttps://agentprime.io/advisories/CVE-2026-55385/https://agentprime.io/advisories/CVE-2026-55385/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 19:25:32 GMTCVECVE-2026-55381: InvoiceShelf: IDOR in InvoiceShelf estimate-to-invoice conversion allows any company user to read and tamper with other companies' estimateshttps://agentprime.io/advisories/CVE-2026-55381/https://agentprime.io/advisories/CVE-2026-55381/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 19:24:20 GMTCVECVE-2026-55383: InvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosurehttps://agentprime.io/advisories/CVE-2026-55383/https://agentprime.io/advisories/CVE-2026-55383/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 19:23:33 GMTCVECVE-2026-55387: InvoiceShelf bulk deletion lacks company scopinghttps://agentprime.io/advisories/CVE-2026-55387/https://agentprime.io/advisories/CVE-2026-55387/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 19:21:49 GMTCVECVE-2026-55386: InvoiceShelf ORDER BY SQL injection through orderByFieldhttps://agentprime.io/advisories/CVE-2026-55386/https://agentprime.io/advisories/CVE-2026-55386/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 19:18:57 GMTCVECVE-2026-55384: InvoiceShelf trusts client-supplied document totalshttps://agentprime.io/advisories/CVE-2026-55384/https://agentprime.io/advisories/CVE-2026-55384/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 19:17:25 GMTCVECVE-2026-55610: InvoiceShelf has cross-company user read/update IDOR that enables cross-tenant account takeoverhttps://agentprime.io/advisories/CVE-2026-55610/https://agentprime.io/advisories/CVE-2026-55610/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 14:38:07 GMTCVECVE-2026-34367: InvoiceShelf: SSRF in Invoice PDF Rendering via Unsanitised HTML in Notes Fieldhttps://agentprime.io/advisories/CVE-2026-34367/https://agentprime.io/advisories/CVE-2026-34367/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 31 Mar 2026 20:16:11 GMTCVECVE-2026-34366: InvoiceShelf: SSRF in Payment Receipt PDF Rendering via Unsanitised HTML in Notes Fieldhttps://agentprime.io/advisories/CVE-2026-34366/https://agentprime.io/advisories/CVE-2026-34366/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 31 Mar 2026 20:05:57 GMTCVECVE-2026-34365: InvoiceShelf: SSRF in Estimate PDF Rendering via Unsanitised HTML in Notes Fieldhttps://agentprime.io/advisories/CVE-2026-34365/https://agentprime.io/advisories/CVE-2026-34365/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 31 Mar 2026 19:44:06 GMTCVE