354 matches found
InvoicePlane 安全漏洞
InvoicePlane is a software application. Provides a self-hosted open source application for managing your quotes, invoices, customers and payments. InvoicePlane version 1.5.11 suffers from a security vulnerability that stems from the absence of any rate limitation on password resets, where reset...
CVE-2021-29024: Files or Directories Accessible to External Parties
In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and file download. Allowing an attacker to directory traversal and download files suppose to be private without authentication...
CVE-2021-29022
In InvoicePlane 1.5.11, the upload feature discloses the full path of the file upload directory...
CVE-2021-29022
In InvoicePlane 1.5.11, the upload feature discloses the full path of the file upload directory...
CVE-2021-29022
In InvoicePlane 1.5.11, the upload feature discloses the full path of the file upload directory...
Design/Logic Flaw
In InvoicePlane 1.5.11, the upload feature discloses the full path of the file upload directory...
CVE-2021-29022
In InvoicePlane 1.5.11, the upload feature discloses the full path of the file upload directory...
CVE-2021-29022
InvoicePlane 1.5.11 is affected by CVE-2021-29022, where the upload feature discloses the full path of the file upload directory. Affected component: the upload handling mechanism in InvoicePlane; root cause indicated by public records as a path disclosure. Impact is limited to confidentiality (p...
CVE-2021-29022: Unrestricted Upload of File with Dangerous Type
In InvoicePlane 1.5.11, the upload feature discloses the full path of the file upload directory...
InvoicePlane 代码问题漏洞
InvoicePlane is a software application. Provides a self-hosted open source application for managing your quotes, invoices, customers and payments. A code issue vulnerability exists in InvoicePlane version 1.5.11. The vulnerability allows an attacker to obtain the full path to the file upload...
CVE-2019-7223
InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoicepassword parameter, aka the "PDF password" field to the "Create Invoice" option. The XSS payload is rendered at an index.php/invoices/view/ URI. NOTE: this is different from CVE-2018-12255...
CVE-2019-7223
InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoicepassword parameter, aka the "PDF password" field to the "Create Invoice" option. The XSS payload is rendered at an index.php/invoices/view/ URI. NOTE: this is different from CVE-2018-12255...
Cross site scripting
InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoicepassword parameter, aka the "PDF password" field to the "Create Invoice" option. The XSS payload is rendered at an index.php/invoices/view/ URI. NOTE: this is different from CVE-2018-12255...
CVE-2019-7223
CVE-2019-7223 is a stored XSS in InvoicePlane 1.5 affecting the PDF password field (index.php/invoices/ajax/save) with the payload rendered on index.php/invoices/view/##. This is documented across multiple feeds (NVD, OSV, CNVD) as a cross-site scripting vulnerability; exploit details, affected v...
CVE-2019-7223
InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoicepassword parameter, aka the "PDF password" field to the "Create Invoice" option. The XSS payload is rendered at an index.php/invoices/view/ URI. NOTE: this is different from CVE-2018-12255...
CVE-2019-7223: Improper Neutralization of Input During Web Page Generation
InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoicepassword parameter, aka the "PDF password" field to the "Create Invoice" option. The XSS payload is rendered at an index.php/invoices/view/ URI. NOTE: this is different from CVE-2018-12255...
InvoicePlane cross-site scripting vulnerability (CNVD-2018-13195)
InvoicePlane is an open source financial system. The system has features to manage quotes, invoices and payments. A cross-site scripting vulnerability exists in InvoicePlane version 1.5.10. A remote attacker can exploit this vulnerability by injecting malicious code into the application with the...
Cross site scripting
An XSS issue was discovered in InvoicePlane 1.5.10 via the "Quote PDF PasswordOptional" field...