invoiceplane invoiceplane

Name: invoiceplane invoiceplane
Brand: invoiceplane

productUS

cpe:2.3:a:invoiceplane:invoiceplane:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

critical

by severity

0critical8high9medium0low

updated 2026-10-28

vulnerabilities (29)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2026-23491US	high7.5	4.61% (92nd)	Exploit	1.6.4	2026-02-18	< 1.6.4
CVE-2026-25548US	—	0.86% (58th)	Exploit	1.7.1	2026-02-18	< 1.7.1
CVE-2026-25594US	—	0.25% (16th)	Exploit	1.7.1	2026-02-18	< 1.7.1
CVE-2026-25596US	—	0.24% (15th)	Exploit	1.7.1	2026-02-18	< 1.7.1
CVE-2026-25595US	—	0.24% (15th)	Exploit	1.7.1	2026-02-18	< 1.7.1
CVE-2021-29024US	high7.5	1.64% (76th)	—	no fix	2021-05-17	= 1.5.11
CVE-2017-18217US	medium6.1	1.28% (70th)	—	1.5.5	2018-03-05	< 1.5.5
CVE-2021-29023US	medium5.3	1.15% (67th)	—	no fix	2021-05-17	= 1.5.11
CVE-2021-29022US	medium5.3	1.08% (65th)	—	no fix	2021-05-10	= 1.5.11
CVE-2017-1000238US	high8.8	1.07% (65th)	—	no fix	2017-11-17	= 1.4.10
CVE-2017-1000508US	medium6.1	1.04% (64th)	—	no fix	2018-02-09	≤ 1.5.4
CVE-2025-67083US	—	0.72% (54th)	—	1.6.4	2026-01-15	< 1.6.4
CVE-2018-12255US	medium6.1	0.72% (54th)	—	no fix	2018-07-03	= 1.5.10
CVE-2024-56975US	—	0.69% (53rd)	—	1.6.2	2025-03-28	< 1.6.2
CVE-2019-7223US	medium5.4	0.67% (52nd)	—	no fix	2019-03-21	1.5.0 → 1.5.9
CVE-2024-12478US	high8.8	0.57% (47th)	—	no fix	2024-12-16	≤ 1.6.1
CVE-2024-12362US	—	0.56% (46th)	—	no fix	2024-12-16	≤ 1.6.1
CVE-2024-12667US	medium5.9	0.53% (45th)	—	no fix	2024-12-16	≤ 1.6.1
CVE-2023-23011US	medium6.1	0.53% (44th)	—	no fix	2023-02-07	= 1.6.0
CVE-2017-1000239US	medium5.4	0.48% (41st)	—	no fix	2017-11-17	= 1.4.10
CVE-2025-67084US	—	0.44% (38th)	—	1.6.4	2026-01-15	< 1.6.4
CVE-2026-24746US	high7.5	0.32% (25th)	—	no fix	2026-02-18	= 1.7.0
CVE-2025-67082US	—	0.32% (25th)	—	1.6.4	2026-01-15	< 1.6.4
CVE-2025-64012US	—	0.30% (23rd)	—	no fix	2025-12-16	= 1.6.1
CVE-2026-24745US	high7.5	0.26% (18th)	—	no fix	2026-02-18	= 1.7.0
CVE-2026-24744US	high7.5	0.26% (18th)	—	no fix	2026-02-18	= 1.7.0
CVE-2026-24743US	high7.5	0.26% (18th)	—	no fix	2026-02-18	= 1.7.0
CVE-2026-26281US	—	0.21% (11th)	—	no fix	2026-02-18	= 1.7.0
CVE-2026-26270US	—	0.20% (10th)	—	no fix	2026-02-18	= 1.7.0

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')15 CVEs
CWE-434Unrestricted Upload of File with Dangerous Type4 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')3 CVEs
CWE-117Improper Output Neutralization for Logs1 CVEs
CWE-284Improper Access Control1 CVEs
CWE-307Improper Restriction of Excessive Authentication Attempts1 CVEs
CWE-552Files or Directories Accessible to External Parties1 CVEs
CWE-613Insufficient Session Expiration1 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE29 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan