Skip to content
OpenAdvisories

Vendor

InvoicePlane

27 known vulnerabilities.

Products

InvoicePlane 27
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 4.8
    CVE-2026-25596 Public exploit

    InvoicePlane has Stored XSS via Product Unit Name in Invoice Item List

    InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in InvoicePlane 1.7.0 via the Product Unit Name fields. An authenticated administrator can inject mali…

    InvoicePlane InvoicePlane
  • Medium 4.8
    CVE-2026-25595 Public exploit

    InvoicePlane has Stored XSS via Invoice Number in Invoice View and Dashboard

    InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in InvoicePlane 1.7.0 via the Invoice Number field. An authenticated administrator can inject maliciou…

    InvoicePlane InvoicePlane
  • Medium 4.8
    CVE-2026-25594 Public exploit

    InvoicePlane has Stored XSS via Family Name in Product Form

    InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in InvoicePlane 1.7.0 via the Family Name field. The `family_name` value is rendered without HTML enco…

    InvoicePlane InvoicePlane