CVE-2026-61608 SolidInvoice's user invitation tokens have no expiry, allowing indefinite unauthorized company access via leaked or old invitation links

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, UserInvitation entities have no expiry timestamp. Invitation links mailed to users remain valid indefinitely, meaning a leaked, forwarded, or archived invitation email can be used at any time in the future to join a compan...

CVE-2026-61608

SolidInvoice , an open-source invoicing platform, is affected by a flaw in its UserInvitation entities prior to version 3.0.1 . The root cause is the absence of an expiry timestamp on invitation tokens, causing mailed invitation links to remain valid indefinitely. An attacker who obtains a leaked...

EUVD-2026-36301

SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, API tokens used to authenticate all REST API requests are stored as plaintext strings in the apitokens database table. Any attacker who obtains read access to the database — through SQL injection, a leaked backup, a...

Bug Finder SASS BILLER 跨站脚本漏洞

Bug Finder SASS BILLER is a SASS-based invoicing and billing platform from Bug Finder, Inc. A cross-site scripting vulnerability exists in Bug Finder SASS BILLER version 1.0, which stems from the presence of certain unknown processing in the file /company/store, leading to cross-site scripting vi...