Vulnerabilidades en InvoicePlane

27 resultados
CVE-2026-23491CRITICALInvoicePlane has Unauthenticated Path Traversal in Guest ControllerEPSS 4.6%CVE-2026-25548CRITICALInvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log PoisoningEPSS 0.9%CVE-2026-33639HIGHInvoicePlane permits DDL injection through tax_rate_decimal_placesEPSS 0.5%CVE-2026-50547HIGHInvoicePlane permits local file inclusion through the e-invoice XML configuration identifierEPSS 0.5%CVE-2026-39353CRITICALInvoicePlane: Remote Code Execution via Writable Templates DirectoryEPSS 0.4%CVE-2026-88003HIGHInvoicePlane: Failure to Revoke Administrative Privileges After Role DowngradeEPSS 0.4%CVE-2026-39372MEDIUMInvoicePlane: Sensitive Information Disclosure via Unstripped EXIF Metadata in AttachmentsEPSS 0.4%CVE-2026-100371HIGHInvoicePlane: Incomplete Authorization Remediation in Users::form() Enables Primary Administrator Account Takeover via Email Reassignment and Password RecoveryEPSS 0.4%CVE-2026-49850HIGHInvoicePlane: Missing CSRF Protection on State-Changing delete ActionsEPSS 0.3%CVE-2026-85291MEDIUMInvoicePlane IDOR: Horizontal Privilege Escalation via Password Change Without Authorization CheckEPSS 0.3%CVE-2026-24746MEDIUMInvoicePlane has a Stored Cross-Site Scripting (XSS) issueEPSS 0.3%CVE-2026-85290MEDIUMInvoicePlane: Log Injection via Unsanitized User Input in Cron Key Error LoggingEPSS 0.3%CVE-2026-100392HIGHInvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)EPSS 0.3%CVE-2026-54790MEDIUMInvoicePlane: Second-order SQL injection through the unvalidated custom_field_table field in the Custom Fields moduleEPSS 0.3%CVE-2026-55561MEDIUMInvoicePlane: Guest user IDOR in quote approval and rejectionEPSS 0.3%CVE-2026-24744MEDIUMInvoicePlane has a Stored Cross-Site Scripting (XSS) issueEPSS 0.3%CVE-2026-24743MEDIUMInvoicePlane has a Stored Cross-Site Scripting (XSS) issueEPSS 0.3%CVE-2026-24745MEDIUMInvoicePlane has a Stored Cross-Site Scripting (XSS) issueEPSS 0.3%CVE-2026-85292MEDIUMInvoicePlane: Loose Type Comparison in Core Authentication Check (Defense-in-Depth)EPSS 0.3%CVE-2026-25594MEDIUMInvoicePlane has Stored XSS via Family Name in Product FormEPSS 0.2%