Known Vulnerabilities for products from Invoiceplane
Listed below are 10 of the newest known vulnerabilities associated with the vendor "Invoiceplane".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2023-23011 json | Cross Site Scripting (XSS) vulnerability in InvoicePlane 1.6 via filter_product input to file modal_product_lookups.php. | 6.1 - MEDIUM | 2023-02-07 | 2023-02-15 |
| CVE-2021-29024 json | In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and file download. Allowing an att... | 7.5 - HIGH | 2021-05-17 | 2023-03-01 |
| CVE-2021-29023 json | InvoicePlane 1.5.11 doesn't have any rate-limiting for password reset and the reset token is generated using a weak mechanism... | 5.3 - MEDIUM | 2021-05-17 | 2023-03-01 |
| CVE-2021-29022 json | In InvoicePlane 1.5.11, the upload feature discloses the full path of the file upload directory. | 5.3 - MEDIUM | 2021-05-10 | 2021-05-19 |
| CVE-2019-7223 json | InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoice_password parameter, aka the "PDF password" field... | 5.4 - MEDIUM | 2019-03-21 | 2019-03-25 |
| CVE-2018-12255 json | An XSS issue was discovered in InvoicePlane 1.5.10 via the "Quote PDF Password(Optional)" field. | 6.1 - MEDIUM | 2018-07-03 | 2018-08-30 |
| CVE-2017-1000508 json | Invoice Plane version 1.5.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in Client's details that can resu... | 6.1 - MEDIUM | 2018-02-09 | 2018-02-26 |
| CVE-2017-1000239 json | InvoicePlane version 1.4.10 is vulnerable to a Stored Cross Site Scripting resulting in allowing an authenticated user to inj... | Not Provided | 2017-11-17 | 2025-04-20 |
| CVE-2017-1000238 json | InvoicePlane version 1.4.10 is vulnerable to a Arbitrary File Upload resulting in an authenticated user can upload a maliciou... | Not Provided | 2017-11-17 | 2025-04-20 |
| CVE-2017-18217 json | An issue was discovered in InvoicePlane before 1.5.5. It was observed that the Email address and Web address parameters are v... | 6.1 - MEDIUM | 2018-03-05 | 2019-04-26 |
Known software with vulnerabilities from Invoiceplane
| Type | Vendor | Product | Version |
|---|---|---|---|
| Application | Invoiceplane | Invoiceplane | 0.9 |