InvoicePlane IDOR: Horizontal Privilege Escalation via Password Change Without Authorization Check

InvoicePlane: Missing CSRF Token Validation on Multiple Delete Endpoints

InvoicePlane: Recurring Invoice State Change via GET Request Without CSRF Protection

An SQL injection vulnerability in InvoicePlane through 1.6.3 has been identified in "maxQuantity" and "minQuantity" parameters when generating a report

Cross Site Scripting (XSS) vulnerability in InvoicePlane 1.6 via filter_product input to file modal_product_lookups.php

An XSS issue was discovered in InvoicePlane 1.5.10 via the "Quote PDF Password(Optional)" field

An issue was discovered in InvoicePlane before 1.5.5

Invoice Plane version 1.5.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in Client's details that can result in execution of javascript code

InvoicePlane: Second-order SQL injection through the unvalidated custom_field_table field in the Custom Fields module

A vulnerability was found in InvoicePlane up to 1.6.1 and classified as problematic

InvoicePlane has Stored Cross-Site Scripting Issue in Identifier Formatting

InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoice_password parameter, aka the "PDF password" field to the "Create Invoice" option

InvoicePlane version 1.4.10 is vulnerable to a Stored Cross Site Scripting resulting in allowing an authenticated user to inject malicious client side script which will be…

InvoicePlane: Log Injection via Unsanitized User Input in Cron Key Error Logging

Directory traversal vulnerability in InvoicePlane through 1.6.3 allows unauthenticated attackers to read files from the server

InvoicePlane 1.5.11 doesn't have any rate-limiting for password reset and the reset token is generated using a weak mechanism that is predictable

In InvoicePlane 1.5.11, the upload feature discloses the full path of the file upload directory

InvoicePlane: Sensitive Information Disclosure via Unstripped EXIF Metadata in Attachments

InvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer Forms

InvoicePlane: Loose Type Comparison in Core Authentication Check (Defense-in-Depth)

InvoicePlane has Stored XSS via Product Unit Name in Invoice Item List

InvoicePlane has Stored XSS via Invoice Number in Invoice View and Dashboard

InvoicePlane has Stored XSS via Family Name in Product Form

InvoicePlane has Stored Cross-Site Scripting (XSS) Issue in Sumex Invoice View

InvoicePlane commit debb446c is vulnerable to Incorrect Access Control

A vulnerability was found in InvoicePlane up to 1.6.1