CVE-2026-26270: falha de média gravidade em InvoicePlane
InvoicePlane has Stored Cross-Site Scripting Issue in Identifier Formatting
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.4epss 0.2%
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in InvoicePlane (latest version) that allows an authenticated user with permissions to manage Invoice Groups to inject malicious JavaScript into the "Identifier Format" field. This script executes when any user views the invoice list or the main dashboard. Version 1.7.1 patches the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
InvoicePlane · InvoicePlaneCVEs relacionadas — InvoicePlane
No mesmo produto, das mais perigosas para as menos.
CVE-2026-23491CRITICALInvoicePlane has Unauthenticated Path Traversal in Guest ControllerEPSS 4.6%CVE-2026-25548CRITICALInvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log PoisoningEPSS 0.9%CVE-2026-33639HIGHInvoicePlane permits DDL injection through tax_rate_decimal_placesEPSS 0.5%CVE-2026-50547HIGHInvoicePlane permits local file inclusion through the e-invoice XML configuration identifierEPSS 0.5%CVE-2026-39353CRITICALInvoicePlane: Remote Code Execution via Writable Templates DirectoryEPSS 0.4%CVE-2026-88003HIGHInvoicePlane: Failure to Revoke Administrative Privileges After Role DowngradeEPSS 0.4%