CVE-2026-33639

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane interpolates the administrator-controlled taxratedecimalplaces setting into an ALTER TABLE statement for iptaxrates in Settings::index without strict integer validation...

CVE-2026-49850 InvoicePlane: Missing CSRF Protection on State-Changing delete Actions

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Invoices::delete and Invoices::deleteinvoicetax as state-changing routes without requiring POST and validating a CSRF token. When an authenticated administrator...

EUVD-2026-87133

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Invoices::delete and Invoices::deleteinvoicetax as state-changing routes without requiring POST and validating a CSRF token. When an authenticated administrator...

CVE-2026-49850 InvoicePlane: Missing CSRF Protection on State-Changing delete Actions

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Invoices::delete and Invoices::deleteinvoicetax as state-changing routes without requiring POST and validating a CSRF token. When an authenticated administrator...

CVE-2026-49850

The open-source invoice management application InvoicePlane is vulnerable to a Cross-Site Request Forgery (CSRF) flaw in versions prior to 1.7.2 . The application fails to require POST requests or validate CSRF tokens for the state-changing routes Invoices::delete() and Invoices::delete_invoice_t...

CVE-2026-49850 InvoicePlane: Missing CSRF Protection on State-Changing delete Actions

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Invoices::delete and Invoices::deleteinvoicetax as state-changing routes without requiring POST and validating a CSRF token. When an authenticated administrator...

EUVD-2026-87132

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Invoices::generatexml method appends a database-derived xmlid to the XMLconfigs helper directory and includes the resulting PHP path without validating the identifier...

CVE-2026-50547

The self-hosted open source application InvoicePlane (versions prior to 1.7.2 ) is vulnerable to Local File Inclusion (LFI) . The root cause is located in the Invoices::generate_xml() method, which appends a database-derived xml_id to the XMLconfigs helper directory and includes the resulting PHP...

CVE-2026-50547 InvoicePlane permits local file inclusion through the e-invoice XML configuration identifier

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Invoices::generatexml method appends a database-derived xmlid to the XMLconfigs helper directory and includes the resulting PHP path without validating the identifier...

CVE-2026-50547 InvoicePlane permits local file inclusion through the e-invoice XML configuration identifier

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Invoices::generatexml method appends a database-derived xmlid to the XMLconfigs helper directory and includes the resulting PHP path without validating the identifier...

CVE-2026-33639 InvoicePlane permits DDL injection through tax_rate_decimal_places

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane interpolates the administrator-controlled taxratedecimalplaces setting into an ALTER TABLE statement for iptaxrates in Settings::index without strict integer validation...

CVE-2026-33639

Versions of InvoicePlane prior to 1.7.2 are vulnerable to DDL injection due to a lack of strict integer validation in the Settings::index() function. The application interpolates the administrator-controlled tax_rate_decimal_places setting directly into an ALTER TABLE statement for ip_tax_rates. ...

EUVD-2026-87131

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane interpolates the administrator-controlled taxratedecimalplaces setting into an ALTER TABLE statement for iptaxrates in Settings::index without strict integer validation...

CVE-2026-33639 InvoicePlane permits DDL injection through tax_rate_decimal_places

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane interpolates the administrator-controlled taxratedecimalplaces setting into an ALTER TABLE statement for iptaxrates in Settings::index without strict integer validation...

CVE-2026-33639 InvoicePlane permits DDL injection through tax_rate_decimal_places

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane interpolates the administrator-controlled taxratedecimalplaces setting into an ALTER TABLE statement for iptaxrates in Settings::index without strict integer validation...

CVE-2026-39353

The open-source invoice management application InvoicePlane is vulnerable to Remote Code Execution (RCE) prior to version 1.7.2-rc-1 . The root cause is that the application builds its permitted template list by scanning a PHP template directory that can be modified via an administrator-controlle...

EUVD-2026-87129

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-rc-1, InvoicePlane builds its permitted template list by scanning a PHP template directory that can be written through an administrator-controlled file-write capability. A malicious...

CVE-2026-39353 InvoicePlane: Remote Code Execution via Writable Templates Directory

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-rc-1, InvoicePlane builds its permitted template list by scanning a PHP template directory that can be written through an administrator-controlled file-write capability. A malicious...

CVE-2026-39353 InvoicePlane: Remote Code Execution via Writable Templates Directory

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-rc-1, InvoicePlane builds its permitted template list by scanning a PHP template directory that can be written through an administrator-controlled file-write capability. A malicious...

CVE-2026-85293

The self-hosted open source application InvoicePlane is vulnerable to Stored Cross-Site Scripting (XSS) in version 1.7.2-beta-1 . The root cause is the failure to enforce email syntax on client_email values, which are then rendered unescaped within double-quoted attributes in the invoice mailer a...