Skip to content
OpenAdvisories

Vendor

SolidInvoice

6 known vulnerabilities.

SolidInvoice at a glance

Last 12 months
6
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 2 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 4 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202640
Aug 202600
Jul 202600
Jun 202620
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

SolidInvoice 6
All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • Medium 6.5
    CVE-2026-61688

    SolidInvoice allows cross-user access to API token request history via writable DataGrid LiveComponent props

    SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, an authenticated user can view the API request history of any other user's API tokens within the same company by manipulating two writable Symfony UX LiveComponent props on the `DataGr…

    SolidInvoice SolidInvoice
  • Medium 5.9
    CVE-2026-61614

    SolidInvoice's long-lived API tokens accepted as URL query parameters, exposing credentials in server logs and browser history

    SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a `?token=` URL query parameter as a fallback to the `X-API-TOKEN` header. This causes long-lived API credentials to be recorded in…

    SolidInvoice SolidInvoice
  • Medium 6.8
    CVE-2026-61608

    SolidInvoice's user invitation tokens have no expiry, allowing indefinite unauthorized company access via leaked or old invitation links

    SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, `UserInvitation` entities have no expiry timestamp. Invitation links mailed to users remain valid indefinitely, meaning a leaked, forwarded, or archived invitation email can be used at…

    SolidInvoice SolidInvoice
  • High 7.5
    CVE-2026-61686

    SolidInvoice: PHP unserialize() called on client-controlled data in DataGrid LiveComponent context prop

    SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the `DataGrid` LiveComponent deserializes a `context` prop value using PHP's `unserialize()` after receiving it from the client. Because the prop is marked `writable: true`, an authent…

    SolidInvoice SolidInvoice
  • High 8.1
    CVE-2026-46489

    SolidInvoice: Unrestricted file upload with no MIME validation allows stored XSS via malicious SVG logo

    SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, the company logo upload feature accepts any file type without validation. An authenticated administrator can upload an SVG file containing embedded JavaScript. This script is base64-e…

    SolidInvoice SolidInvoice
  • High 8.1
    CVE-2026-46622

    SolidInvoice: API tokens stored as plaintext in the database allowing full credential compromise on database breach

    SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, API tokens used to authenticate all REST API requests are stored as plaintext strings in the api_tokens database table. Any attacker who obtains read access to the database — through …

    SolidInvoice SolidInvoice