I
Vendor security profile
invoiceplane
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs18
Critical1
CISA KEV0
Public exploit15
Patch rate%11
Avg. CVSS6.5
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
0
15
0
CVE KEV
CVE severity distribution
18toplam CVE
Critical1 (6%)
High7 (39%)
Medium10 (56%)
Patch and exploitation view
%11
Verified patch
%0
CISA KEV
%83
Public exploit
2Patch available
0Partial
0Workaround
0Vendor: no patch
16Unknown
Latest vulnerabilities
7.0
CVE-2026-100392
InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)
I
Patch status unknownEPSS %0
8.7
CVE-2026-100371
InvoicePlane: Incomplete Authorization Remediation in Users::form() Enables Primary Administrator Account Takeover via Email Reassignment and Password Recovery
I
Patch status unknownEPSS %0
7.5
CVE-2026-88003
InvoicePlane: Failure to Revoke Administrative Privileges After Role Downgrade
I
Patch status unknownEPSS %0
7.5
CVE-2026-49850
InvoicePlane: Missing CSRF Protection on State-Changing delete Actions
I
Patch status unknownEPSS %0
7.5
CVE-2026-50547
InvoicePlane permits local file inclusion through the e-invoice XML configuration identifier
I
Patch status unknownEPSS %0
7.2
CVE-2026-33639
InvoicePlane permits DDL injection through tax_rate_decimal_places
I
Patch status unknownEPSS %0
9.1
CVE-2026-39353
InvoicePlane: Remote Code Execution via Writable Templates Directory
I
Patch status unknownEPSS %0
4.8
CVE-2026-85293
InvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer Forms
I
Patch status unknownEPSS %0
6.5
CVE-2026-85291
InvoicePlane IDOR: Horizontal Privilege Escalation via Password Change Without Authorization Check
I
Patch status unknownEPSS %0
6.5
CVE-2026-85289
InvoicePlane: Missing CSRF Token Validation on Multiple Delete Endpoints
I
Patch status unknownEPSS %0