25 matches found
CVE-2026-55381
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, POST /api/v1/estimates/estimate/convert-to-invoice in ConvertEstimateController authorizes only the caller's create-invoice ability and does...
CVE-2026-55381
The InvoiceShelf web and mobile application is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the ConvertEstimateController prior to version 2.4.0 . The POST /api/v1/estimates/{estimate}/convert-to-invoice endpoint fails to properly authorize access to the specific Esti...
CVE-2026-55381 InvoiceShelf: IDOR in InvoiceShelf estimate-to-invoice conversion allows any company user to read and tamper with other companies' estimates
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, POST /api/v1/estimates/estimate/convert-to-invoice in ConvertEstimateController authorizes only the caller's create-invoice ability and does...
CVE-2026-55383 InvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosure
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf public customer invoice, estimate, and payment routes use an EmailLog token's numeric mailableid without verifying mailabletype,...
CVE-2026-55381: Authorization Bypass Through User-Controlled Key
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, POST /api/v1/estimates/estimate/convert-to-invoice in ConvertEstimateController authorizes only the caller's create-invoice ability and does...
PT-2026-114208
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, POST /api/v1/estimates/estimate/convert-to-invoice in ConvertEstimateController authorizes only the caller's create-invoice ability and does...
CVE-2026-104966
Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates from another workspace through PATCH...
CVE-2026-104966
Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates from another workspace through PATCH...
EUVD-2026-92488
Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates from another workspace through PATCH...
PT-2026-106034
Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0 Description Two endpoint families fail to verify that nested resource identifiers belong to the workspace and project specified in the URL. An authenticated user can read or modify estimates from another workspace...
CVE-2026-104966: Authorization Bypass Through User-Controlled Key
Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates from another workspace through PATCH...
CVE-2025-55903
A HTML injection vulnerability exists in Perfex CRM v3.3.1. The application fails to sanitize user input in the "Bill To" address field within the estimate module. As a result, arbitrary HTML can be injected and rendered unescaped in client-facing documents...
EUVD-2025-33769
A HTML injection vulnerability exists in Perfex CRM v3.3.1. The application fails to sanitize user input in the "Bill To" address field within the estimate module. As a result, arbitrary HTML can be injected and rendered unescaped in client-facing documents...
CVE-2025-55903
A HTML injection vulnerability exists in Perfex CRM v3.3.1. The application fails to sanitize user input in the "Bill To" address field within the estimate module. As a result, arbitrary HTML can be injected and rendered unescaped in client-facing documents...
CVE-2025-55903
A HTML injection vulnerability exists in Perfex CRM v3.3.1. The application fails to sanitize user input in the "Bill To" address field within the estimate module. As a result, arbitrary HTML can be injected and rendered unescaped in client-facing documents...
Learning Obfuscations of LLM Embedding Sequences: Stained Glass Transform
The high cost of ownership of AI compute infrastructure and challenges of robust serving of large language models LLMs has led to a surge in managed Model-as-a-service deployments. Even when enterprises choose on-premises deployments, the compute infrastructure is typically shared across many tea...
Crate Invoice Crater Code Issue Vulnerability
Crater Invoice Crater is an open source web and mobile application from Crater Invoice, Inc. for tracking expenses, payments and creating professional invoices and estimates. Crater Invoice crater suffers from a code issue vulnerability that stems from the unrestricted upload of dangerous types o...
fixr.com XSS vulnerability
Vulnerable URL: http://www.fixr.com/cost-estimates/?description=';...
Microsoft Says Fireball Malware Threat 'Overblown'
Check Point has ramped down its projections on the impact of the recently disclosed Fireball malware after Microsoft called its initial numbers into question. Details on Fireball were published June 1 by Check Point, which said the malware was the work of a Chinese digital marketing agency called...