PT-2024-17570 · Unknown · Invoiceplane

Name of the Vulnerable Software and Affected Versions: InvoicePlane versions up to 1.6.1 Description: A vulnerability was found in InvoicePlane, affecting the function download of the file invoices.php. The manipulation of the invoice argument leads to path traversal. It is possible to initiate t...

CVE-2023-23011

Cross Site Scripting XSS vulnerability in InvoicePlane 1.6 via filterproduct input to file modalproductlookups.php...

Cross site scripting

Cross Site Scripting XSS vulnerability in InvoicePlane 1.6 via filterproduct input to file modalproductlookups.php...

CVE-2023-23011

Cross Site Scripting XSS vulnerability in InvoicePlane 1.6 via filterproduct input to file modalproductlookups.php...

CVE-2023-23011

Cross Site Scripting XSS vulnerability in InvoicePlane 1.6 via filterproduct input to file modalproductlookups.php...

CVE-2023-23011

Cross Site Scripting XSS vulnerability in InvoicePlane 1.6 via filterproduct input to file modalproductlookups.php...

InvoicePlane 跨站脚本漏洞

InvoicePlane is a software application. Provides a self-hosted open source application for managing your quotes, invoices, customers and payments. A security vulnerability exists in InvoicePlane version 1.6, which stems from a cross-site scripting issue in the filterproduct method of the...

CVE-2023-23011

CVE-2023-23011 affects InvoicePlane 1.6. The vulnerability is a Cross Site Scripting (XSS) flaw triggered through the filter_product input in modal_product_lookups.php. The root cause, as reported in the sources, is unsanitized input that can be reflected in the browser, enabling script execution...

Unspecified Vulnerability in InvoicePlane

InvoicePlane is a software application. Provides a self-hosted open source application for managing your quotes, invoices, customers and payments. InvoicePlane version 1.5.11 suffers from a security vulnerability that stems from the absence of any rate limitation on password resets, where reset...

InvoicePlane Path Traversal Vulnerability

InvoicePlane is a software application. Provides a self-hosted open source application for managing your quotes, invoices, customers and payments. InvoicePlane version 1.5.11 suffers from a path traversal vulnerability that originates from a misconfigured web server that allows unauthenticated...

CVE-2021-29023

InvoicePlane 1.5.11 doesn't have any rate-limiting for password reset and the reset token is generated using a weak mechanism that is predictable...

CVE-2021-29023

InvoicePlane 1.5.11 doesn't have any rate-limiting for password reset and the reset token is generated using a weak mechanism that is predictable...

CVE-2021-29024

In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and file download. Allowing an attacker to directory traversal and download files suppose to be private without authentication...

CVE-2021-29024

In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and file download. Allowing an attacker to directory traversal and download files suppose to be private without authentication...

CVE-2021-29024

In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and file download. Allowing an attacker to directory traversal and download files suppose to be private without authentication...

Design/Logic Flaw

InvoicePlane 1.5.11 doesn't have any rate-limiting for password reset and the reset token is generated using a weak mechanism that is predictable...

Directory traversal

In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and file download. Allowing an attacker to directory traversal and download files suppose to be private without authentication...

CVE-2021-29024

CVE-2021-29024 affects InvoicePlane 1.5.11, where a misconfigured web server enables unauthenticated directory listing and file download, effectively allowing directory traversal to private files. The root cause is misconfiguration that permits access to sensitive directories/files without authen...

PT-2021-18027 · Unknown · Invoiceplane

Name of the Vulnerable Software and Affected Versions: InvoicePlane version 1.5.11 Description: The issue concerns a lack of rate-limiting for password reset and the use of a weak mechanism to generate reset tokens, making them predictable. Recommendations: For InvoicePlane version 1.5.11, consid...

CVE-2021-29024

In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and file download. Allowing an attacker to directory traversal and download files suppose to be private without authentication...