CVE-2018-12255

InvoicePlane 1.5.10 contains an XSS vulnerability exposed through the Quote PDF Password(Optional) field. The connected OSV/NVD entries confirm an XSS issue in this version, but no remediation or patch details are provided in the documents.

CVE-2018-12255

An XSS issue was discovered in InvoicePlane 1.5.10 via the "Quote PDF PasswordOptional" field...

CVE-2018-12255: Improper Neutralization of Input During Web Page Generation

An XSS issue was discovered in InvoicePlane 1.5.10 via the "Quote PDF PasswordOptional" field...

InvoicePlane < 1.5.5 XSS Vulnerability

The Email address and Web address parameters are vulnerable to cross-site scripting, related to application/modules/clients/views/view.php, application/modules/invoices/views/view.php and application/modules/quotes/views/view.php. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions...

InvoicePlane cross-site scripting vulnerability (CNVD-2018-04868)

InvoicePlane is an open source financial system. The system has features to manage quotes, invoices and payments. A cross-site scripting vulnerability exists in InvoicePlane versions prior to 1.5.5. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the...

CVE-2017-18217

An issue was discovered in InvoicePlane before 1.5.5. It was observed that the Email address and Web address parameters are vulnerable to Cross Site Scripting, related to application/modules/clients/views/view.php, application/modules/invoices/views/view.php, and...

CVE-2017-18217

InvoicePlane prior to 1.5.5 is affected by a cross-site scripting vulnerability in the Email address and Web address parameters, exploitable via the affected view files: application/modules/clients/views/view.php, application/modules/invoices/views/view.php, and application/modules/quotes/views/v...

CVE-2017-18217

An issue was discovered in InvoicePlane before 1.5.5. It was observed that the Email address and Web address parameters are vulnerable to Cross Site Scripting, related to application/modules/clients/views/view.php, application/modules/invoices/views/view.php, and...

CVE-2017-18217: Improper Neutralization of Input During Web Page Generation

An issue was discovered in InvoicePlane before 1.5.5. It was observed that the Email address and Web address parameters are vulnerable to Cross Site Scripting, related to application/modules/clients/views/view.php, application/modules/invoices/views/view.php, and...

Invoice Plane Cross-Site Scripting Vulnerability (CNVD-2018-04555)

InvoicePlane is an open source financial system. The system has features to manage quotes, invoices and payments. A cross-site scripting vulnerability exists in the client email field in InvoicePlane 1.5.4 and prior versions. A remote attacker can exploit this vulnerability to execute JavaScript...

InvoicePlane Cross-Site Scripting Vulnerability

InvoicePlane is an open source financial system. The system has features to manage quotes, invoices and payments. A cross-site scripting vulnerability exists in InvoicePlane version 1.4.10. A remote attacker could exploit this vulnerability to inject malicious client-side script...

InvoicePlane Arbitrary File Upload Vulnerability

InvoicePlane is an open source financial system. The system has features to manage quotes, invoices and payments. An arbitrary file upload vulnerability exists in InvoicePlane version 1.4.10. An attacker could exploit this vulnerability to upload a malicious file to the web server or possibly...

CVE-2017-1000238

InvoicePlane version 1.4.10 is vulnerable to a Arbitrary File Upload resulting in an authenticated user can upload a malicious file to the webserver. It is possible for an attacker to upload a script which is able to compromise the webserver...

CVE-2017-1000239

InvoicePlane version 1.4.10 is vulnerable to a Stored Cross Site Scripting resulting in allowing an authenticated user to inject malicious client side script which will be executed in the browser of users if they visit the manipulated site...

CVE-2017-1000239

InvoicePlane version 1.4.10 is vulnerable to a Stored Cross Site Scripting resulting in allowing an authenticated user to inject malicious client side script which will be executed in the browser of users if they visit the manipulated site...

Cross site scripting

InvoicePlane version 1.4.10 is vulnerable to a Stored Cross Site Scripting resulting in allowing an authenticated user to inject malicious client side script which will be executed in the browser of users if they visit the manipulated site...

Design/Logic Flaw

InvoicePlane version 1.4.10 is vulnerable to a Arbitrary File Upload resulting in an authenticated user can upload a malicious file to the webserver. It is possible for an attacker to upload a script which is able to compromise the webserver...

CVE-2017-1000238

InvoicePlane version 1.4.10 is vulnerable to a Arbitrary File Upload resulting in an authenticated user can upload a malicious file to the webserver. It is possible for an attacker to upload a script which is able to compromise the webserver...

CVE-2017-1000239

InvoicePlane 1.4.10 is affected by a Stored Cross-Site Scripting vulnerability. An authenticated user can inject malicious client-side script that will run in the browsers of other users who visit the manipulated site. This is described across multiple sources (CVE-2017-1000239 and related record...

CVE-2017-1000238

InvoicePlane version 1.4.10 is vulnerable to a Arbitrary File Upload resulting in an authenticated user can upload a malicious file to the webserver. It is possible for an attacker to upload a script which is able to compromise the webserver...