Advisories · Technology
SolidInvoice.
Every CVE that names SolidInvoice among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.5 Medium
SolidInvoice allows cross-user access to API token request history via writable DataGrid LiveComponent props
- SolidInvoice
- Broken access control
- CVSS 5.9 Medium
SolidInvoice's long-lived API tokens accepted as URL query parameters, exposing credentials in server logs and browser history
- SolidInvoice
- CWE-598
- CVSS 6.8 Medium
SolidInvoice's user invitation tokens have no expiry, allowing indefinite unauthorized company access via leaked or old invitation links
- SolidInvoice
- Authentication bypass
- CVSS 7.5 High
SolidInvoice: PHP unserialize() called on client-controlled data in DataGrid LiveComponent context prop
- SolidInvoice
- Insecure deserialization
- CVSS 8.1 High
SolidInvoice: Unrestricted file upload with no MIME validation allows stored XSS via malicious SVG logo
- SolidInvoice
- Cross-site scripting (XSS)
- Unrestricted file upload
- CVSS 8.1 High
SolidInvoice: API tokens stored as plaintext in the database allowing full credential compromise on database breach
- SolidInvoice
- Information disclosure
- CVSS 5.1 Medium
SolidInvoice Clients clients cross site scripting
- SolidInvoice
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
SolidInvoice Tax Rates rates cross site scripting
- SolidInvoice
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
SolidInvoice Quote quotes cross site scripting
- SolidInvoice
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
SolidInvoice Invoice Creation invoice cross site scripting
- SolidInvoice
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
SolidInvoice Recurring Invoice recurring cross site scripting
- SolidInvoice
- Cross-site scripting (XSS)
- Code injection