CVE-2026-54790 InvoicePlane: Second-order SQL injection through the unvalidated custom_field_table field in the Custom Fields module

The open-source invoice management application InvoicePlane (prior to version 1.7.2 ) is vulnerable to a second-order SQL injection within the Custom Fields module . The root cause is the lack of validation for the administrator-controlled custom_field_table value. The Mdl_custom_fields::used() f...