28 matches found
CVE-2024-12478
A vulnerability was found in InvoicePlane up to 1.6.1. It has been declared as critical. This vulnerability affects the function uploadfile of the file /index.php/upload/uploadfile/1/1. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The...
CVE-2024-12478 InvoicePlane 1 upload_file unrestricted upload
A vulnerability was found in InvoicePlane up to 1.6.1. It has been declared as critical. This vulnerability affects the function uploadfile of the file /index.php/upload/uploadfile/1/1. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The...
CVE-2024-12478 InvoicePlane 1 upload_file unrestricted upload
A vulnerability was found in InvoicePlane up to 1.6.1. It has been declared as critical. This vulnerability affects the function uploadfile of the file /index.php/upload/uploadfile/1/1. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The...
CVE-2024-12478 InvoicePlane 1 upload_file unrestricted upload
A vulnerability was found in InvoicePlane up to 1.6.1. It has been declared as critical. This vulnerability affects the function uploadfile of the file /index.php/upload/uploadfile/1/1. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The...
CVE-2024-12362
A vulnerability was found in InvoicePlane up to 1.6.1. It has been classified as problematic. This affects the function download of the file invoices.php. The manipulation of the argument invoice leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclos...
CVE-2024-12362 InvoicePlane invoices.php download path traversal
A vulnerability was found in InvoicePlane up to 1.6.1. It has been classified as problematic. This affects the function download of the file invoices.php. The manipulation of the argument invoice leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclos...
CVE-2024-12362
Summary: CVE-2024-12362 affects InvoicePlane versions up to 1.6.1. A path traversal vulnerability exists in the invoices.php download function via a manipulated invoice parameter. The issue can be triggered remotely. Multiple sources corroborate that upgrading to version 1.6.2-beta-1 addresses th...
Unspecified Vulnerability in InvoicePlane
InvoicePlane is a software application. Provides a self-hosted open source application for managing your quotes, invoices, customers and payments. InvoicePlane version 1.5.11 suffers from a security vulnerability that stems from the absence of any rate limitation on password resets, where reset...