CVE-2019-7223

CVE-2019-7223 is a stored XSS in InvoicePlane 1.5 affecting the PDF password field (index.php/invoices/ajax/save) with the payload rendered on index.php/invoices/view/##. This is documented across multiple feeds (NVD, OSV, CNVD) as a cross-site scripting vulnerability; exploit details, affected v...

CVE-2019-7223

InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoicepassword parameter, aka the "PDF password" field to the "Create Invoice" option. The XSS payload is rendered at an index.php/invoices/view/ URI. NOTE: this is different from CVE-2018-12255...

InvoicePlane cross-site scripting vulnerability (CNVD-2018-13195)

InvoicePlane is an open source financial system. The system has features to manage quotes, invoices and payments. A cross-site scripting vulnerability exists in InvoicePlane version 1.5.10. A remote attacker can exploit this vulnerability by injecting malicious code into the application with the...

Cross site scripting

An XSS issue was discovered in InvoicePlane 1.5.10 via the "Quote PDF PasswordOptional" field...

CVE-2018-12255

An XSS issue was discovered in InvoicePlane 1.5.10 via the "Quote PDF PasswordOptional" field...

CVE-2018-12255

An XSS issue was discovered in InvoicePlane 1.5.10 via the "Quote PDF PasswordOptional" field...

CVE-2018-12255

An XSS issue was discovered in InvoicePlane 1.5.10 via the "Quote PDF PasswordOptional" field...

CVE-2018-12255

InvoicePlane 1.5.10 contains an XSS vulnerability exposed through the Quote PDF Password(Optional) field. The connected OSV/NVD entries confirm an XSS issue in this version, but no remediation or patch details are provided in the documents.

InvoicePlane < 1.5.5 XSS Vulnerability

The Email address and Web address parameters are vulnerable to cross-site scripting, related to application/modules/clients/views/view.php, application/modules/invoices/views/view.php and application/modules/quotes/views/view.php. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions...

InvoicePlane cross-site scripting vulnerability (CNVD-2018-04868)

InvoicePlane is an open source financial system. The system has features to manage quotes, invoices and payments. A cross-site scripting vulnerability exists in InvoicePlane versions prior to 1.5.5. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the...

CVE-2017-18217

An issue was discovered in InvoicePlane before 1.5.5. It was observed that the Email address and Web address parameters are vulnerable to Cross Site Scripting, related to application/modules/clients/views/view.php, application/modules/invoices/views/view.php, and...

CVE-2017-18217

InvoicePlane prior to 1.5.5 is affected by a cross-site scripting vulnerability in the Email address and Web address parameters, exploitable via the affected view files: application/modules/clients/views/view.php, application/modules/invoices/views/view.php, and application/modules/quotes/views/v...

CVE-2017-18217

An issue was discovered in InvoicePlane before 1.5.5. It was observed that the Email address and Web address parameters are vulnerable to Cross Site Scripting, related to application/modules/clients/views/view.php, application/modules/invoices/views/view.php, and...

Invoice Plane Cross-Site Scripting Vulnerability (CNVD-2018-04555)

InvoicePlane is an open source financial system. The system has features to manage quotes, invoices and payments. A cross-site scripting vulnerability exists in the client email field in InvoicePlane 1.5.4 and prior versions. A remote attacker can exploit this vulnerability to execute JavaScript...

InvoicePlane Cross-Site Scripting Vulnerability

InvoicePlane is an open source financial system. The system has features to manage quotes, invoices and payments. A cross-site scripting vulnerability exists in InvoicePlane version 1.4.10. A remote attacker could exploit this vulnerability to inject malicious client-side script...

InvoicePlane Arbitrary File Upload Vulnerability

InvoicePlane is an open source financial system. The system has features to manage quotes, invoices and payments. An arbitrary file upload vulnerability exists in InvoicePlane version 1.4.10. An attacker could exploit this vulnerability to upload a malicious file to the web server or possibly...

CVE-2017-1000239

InvoicePlane version 1.4.10 is vulnerable to a Stored Cross Site Scripting resulting in allowing an authenticated user to inject malicious client side script which will be executed in the browser of users if they visit the manipulated site...

CVE-2017-1000238

InvoicePlane version 1.4.10 is vulnerable to a Arbitrary File Upload resulting in an authenticated user can upload a malicious file to the webserver. It is possible for an attacker to upload a script which is able to compromise the webserver...

Cross site scripting

InvoicePlane version 1.4.10 is vulnerable to a Stored Cross Site Scripting resulting in allowing an authenticated user to inject malicious client side script which will be executed in the browser of users if they visit the manipulated site...

Design/Logic Flaw

InvoicePlane version 1.4.10 is vulnerable to a Arbitrary File Upload resulting in an authenticated user can upload a malicious file to the webserver. It is possible for an attacker to upload a script which is able to compromise the webserver...