CVE-2026-24746: falha de média gravidade em InvoicePlane
InvoicePlane has a Stored Cross-Site Scripting (XSS) issue
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.7epss 0.3%
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the Edit Quotes functions of InvoicePlane version 1.7.0. In the Editing Quotes function, the application does not validate user input at the quote_number parameter. Although administrator privileges are required to exploit it, this is still considered a critical vulnerability as it can cause actions such as unauthorized modification of application data, creation of persistent backdoors through stored malicious scripts, and full compromise of the application's integrity. Version 1.7.1 patches the issue.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:L
Produtos afetados
InvoicePlane · InvoicePlaneCVEs relacionadas — InvoicePlane
No mesmo produto, das mais perigosas para as menos.
CVE-2026-23491CRITICALInvoicePlane has Unauthenticated Path Traversal in Guest ControllerEPSS 4.6%CVE-2026-25548CRITICALInvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log PoisoningEPSS 0.9%CVE-2026-33639HIGHInvoicePlane permits DDL injection through tax_rate_decimal_placesEPSS 0.5%CVE-2026-50547HIGHInvoicePlane permits local file inclusion through the e-invoice XML configuration identifierEPSS 0.5%CVE-2026-39353CRITICALInvoicePlane: Remote Code Execution via Writable Templates DirectoryEPSS 0.4%CVE-2026-88003HIGHInvoicePlane: Failure to Revoke Administrative Privileges After Role DowngradeEPSS 0.4%