230 matches found
CVE-2021-29023
InvoicePlane 1.5.11 doesn't have any rate-limiting for password reset and the reset token is generated using a weak mechanism that is predictable...
PT-2021-18028 · Unknown · Invoiceplane
Name of the Vulnerable Software and Affected Versions: InvoicePlane version 1.5.11 Description: The issue allows unauthenticated directory listing and file download due to a misconfigured web server. This enables an attacker to perform directory traversal and download files that are supposed to b...
InvoicePlane 路径遍历漏洞
InvoicePlane is a software application. Provides a self-hosted open source application for managing your quotes, invoices, customers and payments. InvoicePlane version 1.5.11 suffers from a path traversal vulnerability that originates from a misconfigured web server that allows unauthenticated...
InvoicePlane 安全漏洞
InvoicePlane is a software application. Provides a self-hosted open source application for managing your quotes, invoices, customers and payments. InvoicePlane version 1.5.11 suffers from a security vulnerability that stems from the absence of any rate limitation on password resets, where reset...
CVE-2021-29023
InvoicePlane 1.5.11 is affected by a vulnerability where there is no rate limiting for password resets and the reset token is generated by a weak, predictable mechanism. Affected component is the password reset flow within InvoicePlane; root cause is lack of rate-limiting and weak token generatio...
CVE-2021-29022
In InvoicePlane 1.5.11, the upload feature discloses the full path of the file upload directory...
CVE-2021-29022
In InvoicePlane 1.5.11, the upload feature discloses the full path of the file upload directory...
Design/Logic Flaw
In InvoicePlane 1.5.11, the upload feature discloses the full path of the file upload directory...
CVE-2021-29022
In InvoicePlane 1.5.11, the upload feature discloses the full path of the file upload directory...
CVE-2021-29022
InvoicePlane 1.5.11 is affected by CVE-2021-29022, where the upload feature discloses the full path of the file upload directory. Affected component: the upload handling mechanism in InvoicePlane; root cause indicated by public records as a path disclosure. Impact is limited to confidentiality (p...
InvoicePlane 代码问题漏洞
InvoicePlane is a software application. Provides a self-hosted open source application for managing your quotes, invoices, customers and payments. A code issue vulnerability exists in InvoicePlane version 1.5.11. The vulnerability allows an attacker to obtain the full path to the file upload...
CVE-2019-7223
InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoicepassword parameter, aka the "PDF password" field to the "Create Invoice" option. The XSS payload is rendered at an index.php/invoices/view/ URI. NOTE: this is different from CVE-2018-12255...
CVE-2019-7223
InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoicepassword parameter, aka the "PDF password" field to the "Create Invoice" option. The XSS payload is rendered at an index.php/invoices/view/ URI. NOTE: this is different from CVE-2018-12255...
Cross site scripting
InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoicepassword parameter, aka the "PDF password" field to the "Create Invoice" option. The XSS payload is rendered at an index.php/invoices/view/ URI. NOTE: this is different from CVE-2018-12255...
CVE-2019-7223
CVE-2019-7223 is a stored XSS in InvoicePlane 1.5 affecting the PDF password field (index.php/invoices/ajax/save) with the payload rendered on index.php/invoices/view/##. This is documented across multiple feeds (NVD, OSV, CNVD) as a cross-site scripting vulnerability; exploit details, affected v...
CVE-2019-7223
InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoicepassword parameter, aka the "PDF password" field to the "Create Invoice" option. The XSS payload is rendered at an index.php/invoices/view/ URI. NOTE: this is different from CVE-2018-12255...
InvoicePlane cross-site scripting vulnerability (CNVD-2018-13195)
InvoicePlane is an open source financial system. The system has features to manage quotes, invoices and payments. A cross-site scripting vulnerability exists in InvoicePlane version 1.5.10. A remote attacker can exploit this vulnerability by injecting malicious code into the application with the...
CVE-2018-12255
An XSS issue was discovered in InvoicePlane 1.5.10 via the "Quote PDF PasswordOptional" field...