Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

VulnScan

InvoicePlane Security Vulnerabilities | CyStack CVE Database

Vulnerability	Exploitation status	Fix	Affected product	Published	Severity

`CVE-2026-100392`InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)	Exploitation statusPublic exploit	FixNot confirmed	Affected productInvoicePlane	Published09/28/2026	SeverityHigh
`CVE-2026-100371`InvoicePlane: Incomplete Authorization Remediation in Users::form() Enables Primary Administrator Account Takeover via Email Reassignment and Password Recovery	Exploitation statusPublic exploit	FixNot confirmed	Affected productInvoicePlane	Published09/28/2026	SeverityHigh
`CVE-2026-88003`InvoicePlane: Failure to Revoke Administrative Privileges After Role Downgrade	Exploitation statusPublic exploit	FixYes	Affected productInvoicePlane	Published09/25/2026	SeverityHigh
`CVE-2026-49850`InvoicePlane: Missing CSRF Protection on State-Changing delete Actions	Exploitation statusNot known exploited	FixYes	Affected productInvoicePlane	Published09/25/2026	SeverityHigh
`CVE-2026-50547`InvoicePlane permits local file inclusion through the e-invoice XML configuration identifier	Exploitation statusNot known exploited	FixYes	Affected productInvoicePlane	Published09/25/2026	SeverityHigh
`CVE-2026-33639`InvoicePlane permits DDL injection through tax_rate_decimal_places	Exploitation statusPublic exploit	FixYes	Affected productInvoicePlane	Published09/25/2026	SeverityHigh
`CVE-2026-39353`InvoicePlane: Remote Code Execution via Writable Templates Directory	Exploitation statusPublic exploit	FixYes	Affected productInvoicePlane	Published09/25/2026	SeverityCritical
`CVE-2026-85293`InvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer Forms	Exploitation statusPublic exploit	FixYes	Affected productInvoicePlane	Published09/25/2026	SeverityMedium
`CVE-2026-85291`InvoicePlane IDOR: Horizontal Privilege Escalation via Password Change Without Authorization Check	Exploitation statusPublic exploit	FixYes	Affected productInvoicePlane	Published09/25/2026	SeverityMedium
`CVE-2026-85289`InvoicePlane: Missing CSRF Token Validation on Multiple Delete Endpoints	Exploitation statusPublic exploit	FixYes	Affected productInvoicePlane	Published09/25/2026	SeverityMedium
`CVE-2026-85292`InvoicePlane: Loose Type Comparison in Core Authentication Check (Defense-in-Depth)	Exploitation statusNot known exploited	FixYes	Affected productInvoicePlane	Published09/25/2026	SeverityMedium
`CVE-2026-85274`InvoicePlane: Recurring Invoice State Change via GET Request Without CSRF Protection	Exploitation statusPublic exploit	FixYes	Affected productInvoicePlane	Published09/25/2026	SeverityMedium
`CVE-2026-85290`InvoicePlane: Log Injection via Unsanitized User Input in Cron Key Error Logging	Exploitation statusPublic exploit	FixYes	Affected productInvoicePlane	Published09/25/2026	SeverityMedium
`CVE-2026-39372`InvoicePlane: Sensitive Information Disclosure via Unstripped EXIF Metadata in Attachments	Exploitation statusPublic exploit	FixYes	Affected productInvoicePlane	Published09/25/2026	SeverityMedium
`CVE-2026-54790`InvoicePlane: Second-order SQL injection through the unvalidated custom_field_table field in the Custom Fields module	Exploitation statusPublic exploit	FixYes	Affected productInvoicePlane	Published09/25/2026	SeverityMedium
`CVE-2026-26281`InvoicePlane has Stored Cross-Site Scripting (XSS) Issue in Sumex Invoice View	Exploitation statusPublic exploit	FixNot confirmed	Affected productInvoicePlane	Published02/18/2026	SeverityMedium
`CVE-2026-26270`InvoicePlane has Stored Cross-Site Scripting Issue in Identifier Formatting	Exploitation statusPublic exploit	FixNot confirmed	Affected productInvoicePlane	Published02/18/2026	SeverityMedium
`CVE-2026-25596`InvoicePlane has Stored XSS via Product Unit Name in Invoice Item List	Exploitation statusPublic exploit	FixNot confirmed	Affected productInvoicePlane	Published02/18/2026	SeverityMedium
`CVE-2026-25595`InvoicePlane has Stored XSS via Invoice Number in Invoice View and Dashboard	Exploitation statusNot known exploited	FixNot confirmed	Affected productInvoicePlane	Published02/18/2026	SeverityMedium
`CVE-2026-25594`InvoicePlane has Stored XSS via Family Name in Product Form	Exploitation statusNot known exploited	FixNot confirmed	Affected productInvoicePlane	Published02/18/2026	SeverityMedium
`CVE-2026-25548`InvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoning	Exploitation statusNot known exploited	FixNot confirmed	Affected productInvoicePlane	Published02/18/2026	SeverityCritical
`CVE-2026-24745`InvoicePlane has a Stored Cross-Site Scripting (XSS) issue	Exploitation statusPublic exploit	FixNot confirmed	Affected productInvoicePlane	Published02/18/2026	SeverityMedium
`CVE-2026-24744`InvoicePlane has a Stored Cross-Site Scripting (XSS) issue	Exploitation statusPublic exploit	FixNot confirmed	Affected productInvoicePlane	Published02/18/2026	SeverityMedium
`CVE-2026-24743`InvoicePlane has a Stored Cross-Site Scripting (XSS) issue	Exploitation statusPublic exploit	FixNot confirmed	Affected productInvoicePlane	Published02/18/2026	SeverityMedium
`CVE-2026-24746`InvoicePlane has a Stored Cross-Site Scripting (XSS) issue	Exploitation statusPublic exploit	FixNot confirmed	Affected productInvoicePlane	Published02/18/2026	SeverityMedium
`CVE-2026-23491`InvoicePlane has Unauthenticated Path Traversal in Guest Controller	Exploitation statusPublic exploit	FixNot confirmed	Affected productInvoicePlane	Published02/18/2026	SeverityCritical
`CVE-2025-67082`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published01/15/2026	SeverityMedium
`CVE-2025-67084`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published01/15/2026	SeverityCritical
`CVE-2025-67083`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published01/15/2026	SeverityMedium
`CVE-2025-64012`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published12/16/2025	SeverityMedium
`CVE-2024-56975`	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published03/28/2025	SeverityCritical
`CVE-2024-12667`InvoicePlane view session expiration	Exploitation statusNot known exploited	FixYes	Affected productInvoicePlane	Published12/16/2024	SeverityMedium
`CVE-2024-12478`InvoicePlane 1 upload_file unrestricted upload	Exploitation statusNot known exploited	FixYes	Affected productInvoicePlane	Published12/16/2024	SeverityMedium
`CVE-2024-12362`InvoicePlane invoices.php download path traversal	Exploitation statusNot known exploited	FixYes	Affected productInvoicePlane	Published12/16/2024	SeverityMedium
`CVE-2023-23011`	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published02/07/2023	SeverityMedium
`CVE-2021-29024`	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published05/17/2021	SeverityUnknown
`CVE-2021-29023`	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published05/17/2021	SeverityUnknown
`CVE-2021-29022`	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published05/10/2021	SeverityUnknown
`CVE-2019-7223`	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published03/16/2019	SeverityUnknown
`CVE-2018-12255`	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published07/03/2018	SeverityUnknown
`CVE-2017-18217`	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published03/05/2018	SeverityUnknown
`CVE-2017-1000508`	Exploitation statusNot confirmed	FixYes	Affected productNot confirmed	Published02/09/2018	SeverityUnknown
`CVE-2017-1000238`	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published11/17/2017	SeverityUnknown
`CVE-2017-1000239`	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published11/17/2017	SeverityUnknown

44 / 44 Results

All vulnerabilities loaded

Security vulnerabilities from InvoicePlane

InvoicePlane

How many security vulnerabilities does InvoicePlane have?

Which InvoicePlane product has the most security vulnerabilities?

Filters

Run an in-depth assessment with complete web risk management

Popular InvoicePlane products

InvoicePlane