CVE-2026-26281: falha de média gravidade em InvoicePlane
InvoicePlane has Stored Cross-Site Scripting (XSS) Issue in Sumex Invoice View
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.4epss 0.2%
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A stored cross-site scripting (XSS) vulnerability in the Sumex invoice view allows an authenticated user with client and invoice management privileges to execute arbitrary JavaScript in the browser of any user viewing the invoice. This can lead to session hijacking, data theft, or other malicious actions on behalf of the victim user. Version 1.7.1 patches the issue.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
InvoicePlane · InvoicePlaneCVEs relacionadas — InvoicePlane
No mesmo produto, das mais perigosas para as menos.
CVE-2026-23491CRITICALInvoicePlane has Unauthenticated Path Traversal in Guest ControllerEPSS 4.6%CVE-2026-25548CRITICALInvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log PoisoningEPSS 0.9%CVE-2026-33639HIGHInvoicePlane permits DDL injection through tax_rate_decimal_placesEPSS 0.5%CVE-2026-50547HIGHInvoicePlane permits local file inclusion through the e-invoice XML configuration identifierEPSS 0.5%CVE-2026-39353CRITICALInvoicePlane: Remote Code Execution via Writable Templates DirectoryEPSS 0.4%CVE-2026-88003HIGHInvoicePlane: Failure to Revoke Administrative Privileges After Role DowngradeEPSS 0.4%