CVE-2026-55561 InvoicePlane: Guest user IDOR in quote approval and rejection

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-beta-1, guest users can approve or reject quotes belonging to any client, not just their assigned clients. The approve and reject methods in the Guest Quotes controller,...

CVE-2026-55561

Prior to version 1.7.2-beta-1 , the InvoicePlane application is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the Guest Quotes controller (application/modules/guest/controllers/Quotes.php). The approve() and reject() methods call approve_quote_by_id($quote_id) and reje...

lifeant.com XSS vulnerability

Open Bug Bounty ID: OBB-661759 Description| Value ---|--- Affected Website:| lifeant.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

the-automover.com XSS vulnerability

Open Bug Bounty ID: OBB-655840 Description| Value ---|--- Affected Website:| the-automover.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Sql injection

Multiple SQL injection vulnerabilities in QuoteBook allow remote attackers to execute arbitrary SQL commands via the 1 MyBox and 2 selectFavorites parameters to a quotes.php and the 3 QuoteName and 4 QuoteText parameters to b quotesadd.php. NOTE: the provenance of this information is unknown; the...

CVE-2009-0829: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in QuoteBook allow remote attackers to execute arbitrary SQL commands via the 1 MyBox and 2 selectFavorites parameters to a quotes.php and the 3 QuoteName and 4 QuoteText parameters to b quotesadd.php. NOTE: the provenance of this information is unknown; the...

CVE-2007-1837: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in MangoBery CMS 0.5.5 allow remote attackers to execute arbitrary PHP code via a URL in the SitePath parameter to 1 boxes/quotes.php or 2 templates/mangobery/footer.sample.php...

MangoBery CMS 0.5.5 (quotes.php) Remote File Inclusion Vulnerability

Mangobery-0.5.5 Found by kezzap66345 Script Page:http://mangobery.sourceforge.net/ Demo Site:http://mangobery.beryllium.ca/ Script Download:http://sourceforge.net/project/showfiles.php?groupid=63834&packageid=60858 Dork:http://www.google.com.tr/search?hl=tr&q=22MangoBery+1.0+Alpha22&meta= ERROR1:...

MangoBery CMS 0.5.5 (quotes.php) Remote File Inclusion Vulnerability

No description provided by source. Mangobery-0.5.5 Found by kezzap66345 Script Page:http://mangobery.sourceforge.net/ Demo Site:http://mangobery.beryllium.ca/ Script Download:http://sourceforge.net/project/showfiles.php?groupid=63834&packageid=60858...

MangoBery CMS 0.5.5 (quotes.php) Remote File Inclusion Vulnerability

Exploit for unknown platform in category web applications ==================================================================== MangoBery CMS 0.5.5 quotes.php Remote File Inclusion Vulnerability ==================================================================== Mangobery-0.5.5 Found by kezzap663...

MangoBery CMS 0.5.5 - 'quotes.php' Remote File Inclusion

Mangobery-0.5.5 Found by kezzap66345 Script Page:http://mangobery.sourceforge.net/ Demo Site:http://mangobery.beryllium.ca/ Script Download:http://sourceforge.net/project/showfiles.php?groupid=63834&packageid=60858 Dork:http://www.google.com.tr/search?hl=tr&q=%22MangoBery+1.0+Alpha%22&meta= ERROR...