CVE-2026-54790

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores an administrator-controlled customfieldtable value without validating it against the allowed custom-field table names. Mdlcustomfields::used later concatenates...

CVE-2026-54790 InvoicePlane: Second-order SQL injection through the unvalidated custom_field_table field in the Custom Fields module

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores an administrator-controlled customfieldtable value without validating it against the allowed custom-field table names. Mdlcustomfields::used later concatenates...

CVE-2026-54790 InvoicePlane: Second-order SQL injection through the unvalidated custom_field_table field in the Custom Fields module

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores an administrator-controlled customfieldtable value without validating it against the allowed custom-field table names. Mdlcustomfields::used later concatenates...

CVE-2026-54790

The open-source invoice management application InvoicePlane (prior to version 1.7.2 ) is vulnerable to a second-order SQL injection within the Custom Fields module . The root cause is the lack of validation for the administrator-controlled custom_field_table value. The Mdl_custom_fields::used() f...

CVE-2026-54790 InvoicePlane: Second-order SQL injection through the unvalidated custom_field_table field in the Custom Fields module

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores an administrator-controlled customfieldtable value without validating it against the allowed custom-field table names. Mdlcustomfields::used later concatenates...

CVE-2026-54790: Improper Neutralization of Special Elements used in an SQL Command

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores an administrator-controlled customfieldtable value without validating it against the allowed custom-field table names. Mdlcustomfields::used later concatenates...