https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-26281.htmlhttps://patchthecve.com/cve/CVE-2026-26281.htmlWed, 17 Jun 2026 10:26:02 +0000MEDIUM 4.4: InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A stored cross-site scripting (XSS) vulnerability in the Sumex invoice view allows an authenticated user with client and invoice management privileges to execute arbitrary JavaScript in the browser ofhttps://patchthecve.com/cve/CVE-2026-26270.htmlhttps://patchthecve.com/cve/CVE-2026-26270.htmlWed, 17 Jun 2026 10:26:01 +0000MEDIUM 5.4: InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in InvoicePlane (latest version) that allows an authenticated user with permissions to manage Invoice Groups to inject malicious JavaScript inthttps://patchthecve.com/cve/CVE-2026-25596.htmlhttps://patchthecve.com/cve/CVE-2026-25596.htmlWed, 17 Jun 2026 10:24:55 +0000MEDIUM 4.8: InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in InvoicePlane 1.7.0 via the Product Unit Name fields. An authenticated administrator can inject malicious JavaScript that executes when any ahttps://patchthecve.com/cve/CVE-2026-25595.htmlhttps://patchthecve.com/cve/CVE-2026-25595.htmlWed, 17 Jun 2026 10:24:55 +0000MEDIUM 4.8: InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in InvoicePlane 1.7.0 via the Invoice Number field. An authenticated administrator can inject malicious JavaScript that executes when any adminhttps://patchthecve.com/cve/CVE-2026-25594.htmlhttps://patchthecve.com/cve/CVE-2026-25594.htmlWed, 17 Jun 2026 10:24:55 +0000MEDIUM 4.8: InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in InvoicePlane 1.7.0 via the Family Name field. The `family_name` value is rendered without HTML encoding inside the family dropdown on the prhttps://patchthecve.com/cve/CVE-2026-25548.htmlhttps://patchthecve.com/cve/CVE-2026-25548.htmlWed, 17 Jun 2026 10:24:50 +0000CRITICAL 9.1: InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A critical Remote Code Execution (RCE) vulnerability exists in InvoicePlane 1.7.0 through a chained Local File Inclusion (LFI) and Log Poisoning attack. An authenticated administrator can execute arbihttps://patchthecve.com/cve/CVE-2026-24745.htmlhttps://patchthecve.com/cve/CVE-2026-24745.htmlWed, 17 Jun 2026 10:23:31 +0000MEDIUM 5.7: InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the upload Login Logo functions of InvoicePlane version 1.7.0. In the Upload Login Logo, the application allows uploading svg files. Althoughttps://patchthecve.com/cve/CVE-2026-24744.htmlhttps://patchthecve.com/cve/CVE-2026-24744.htmlWed, 17 Jun 2026 10:23:31 +0000MEDIUM 5.7: InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the Edit Invoices functions of InvoicePlane version 1.7.0. When editing invoices, the application does not validate user input at the `invoihttps://patchthecve.com/cve/CVE-2026-24743.htmlhttps://patchthecve.com/cve/CVE-2026-24743.htmlWed, 17 Jun 2026 10:23:31 +0000MEDIUM 5.7: InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the upload Invoice Logo functions of InvoicePlane version 1.7.0. The Upload Invoice Logo function allows the application to upload svg fileshttps://patchthecve.com/cve/CVE-2026-24746.htmlhttps://patchthecve.com/cve/CVE-2026-24746.htmlWed, 17 Jun 2026 10:23:31 +0000MEDIUM 5.7: InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the Edit Quotes functions of InvoicePlane version 1.7.0. In the Editing Quotes function, the application does not validate user input at thehttps://patchthecve.com/cve/CVE-2026-23491.htmlhttps://patchthecve.com/cve/CVE-2026-23491.htmlWed, 17 Jun 2026 10:21:41 +0000HIGH 7.5: InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A path traversal vulnerability exists in the `get_file` method of the `Guest` module's `Get` controller in InvoicePlane up to and including through 1.6.3. The vulnerability allows unauthenticated attahttps://patchthecve.com/cve/CVE-2025-67084.htmlhttps://patchthecve.com/cve/CVE-2025-67084.htmlWed, 17 Jun 2026 09:57:26 +0000CRITICAL 9.9: File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Execution (RCE).https://patchthecve.com/cve/CVE-2025-67083.htmlhttps://patchthecve.com/cve/CVE-2025-67083.htmlWed, 17 Jun 2026 09:57:25 +0000MEDIUM 5.3: Directory traversal vulnerability in InvoicePlane through 1.6.3 allows unauthenticated attackers to read files from the server. The ability to read files and the file type depends on the web server and its configuration.https://patchthecve.com/cve/CVE-2025-67082.htmlhttps://patchthecve.com/cve/CVE-2025-67082.htmlWed, 17 Jun 2026 09:57:25 +0000MEDIUM 6.5: An SQL injection vulnerability in InvoicePlane through 1.6.3 has been identified in "maxQuantity" and "minQuantity" parameters when generating a report. An authenticated attacker can exploit this issue via error-based SQL injection, allowing for the extraction of arbitrary data from the database. Thhttps://patchthecve.com/cve/CVE-2025-64012.htmlhttps://patchthecve.com/cve/CVE-2025-64012.htmlTue, 13 Oct 2026 19:10:00 +0000MEDIUM 4.3: InvoicePlane commit debb446c is vulnerable to Incorrect Access Control. The invoices/view handler fails to verify ownership before returning invoice data.https://patchthecve.com/cve/CVE-2024-56975.htmlhttps://patchthecve.com/cve/CVE-2024-56975.htmlWed, 17 Jun 2026 08:13:09 +0000CRITICAL 9.8: InvoicePlane (all versions tested as of December 2024) v.1.6.11 and before contains a remote code execution vulnerability in the upload_file method of the Upload controller.https://patchthecve.com/cve/CVE-2024-12667.htmlhttps://patchthecve.com/cve/CVE-2024-12667.htmlWed, 17 Jun 2026 07:00:15 +0000LOW 3.7: A vulnerability was found in InvoicePlane up to 1.6.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /invoices/view. The manipulation leads to session expiration. The attack may be launched remotely. The complexity of an attack is rather high. The exphttps://patchthecve.com/cve/CVE-2024-12478.htmlhttps://patchthecve.com/cve/CVE-2024-12478.htmlWed, 17 Jun 2026 06:59:47 +0000MEDIUM 6.3: A vulnerability was found in InvoicePlane up to 1.6.1. It has been declared as critical. This vulnerability affects the function upload_file of the file /index.php/upload/upload_file/1/1. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exhttps://patchthecve.com/cve/CVE-2024-12362.htmlhttps://patchthecve.com/cve/CVE-2024-12362.htmlWed, 17 Jun 2026 06:59:34 +0000MEDIUM 4.3: A vulnerability was found in InvoicePlane up to 1.6.1. It has been classified as problematic. This affects the function download of the file invoices.php. The manipulation of the argument invoice leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed