Login Request a demo
IN
Product
InvoicePlane
by InvoicePlane · last CVE Oct 28, 2026
45
CVEs
0
On KEV
9.9
Max CVSS
1
New 30D
Vulnerabilities45In the news0Timeline
Severity mix
Critical 4High 14Medium 27Low 0
Severity
All severities45Critical4High14Medium27Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add InvoicePlane to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2024-12478
8.8
1%
Dec 16
A vulnerability was found in InvoicePlane up to 1.6.1
Affected: through 1.6.1
CVE-2017-1000238
8.8
1%
Nov 17
InvoicePlane version 1.4.10 is vulnerable to a Arbitrary File Upload resulting in an authenticated user can upload a malicious file to the webserver
Affected: 1.4.10
CVE-2026-100371
8.7
0%
Sep 28
InvoicePlane: Incomplete Authorization Remediation in Users::form() Enables Primary Administrator Account Takeover via Email Reassignment and Password Recovery
Affected: = 1.7.2
CVE-2026-88003
7.5
0%
Sep 25
InvoicePlane: Failure to Revoke Administrative Privileges After Role Downgrade
Affected: < 1.7.2
CVE-2026-49850
7.5
0%
Sep 25
InvoicePlane: Missing CSRF Protection on State-Changing delete Actions
Affected: < 1.7.2
CVE-2026-50547
7.5
0%
Sep 25
InvoicePlane permits local file inclusion through the e-invoice XML configuration identifier
Affected: < 1.7.2
CVE-2026-24745
7.5
0%
Feb 18
InvoicePlane has a Stored Cross-Site Scripting (XSS) issue
Affected: = 1.7.0
CVE-2026-24744
7.5
0%
Feb 18
InvoicePlane has a Stored Cross-Site Scripting (XSS) issue
Affected: = 1.7.0
CVE-2026-24743
7.5
0%
Feb 18
InvoicePlane has a Stored Cross-Site Scripting (XSS) issue
Affected: = 1.7.0
CVE-2026-24746
7.5
0%
Feb 18
InvoicePlane has a Stored Cross-Site Scripting (XSS) issue
Affected: = 1.7.0
CVE-2026-23491
7.5
5%
Feb 18
InvoicePlane has Unauthenticated Path Traversal in Guest Controller
Affected: < 1.6.4
CVE-2021-29024
7.5
2%
May 17
In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and file download
Affected: 1.5.11
CVE-2026-33639
7.2
1%
Sep 25
InvoicePlane permits DDL injection through tax_rate_decimal_places
Affected: < 1.7.2
CVE-2026-100392
7.0
0%
Sep 28
InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)
Affected: = 1.7.2
Showing 14