Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.8
InvoicePlane: Malicious Code Can Be Injected into Invoices
CVE-2026-25595
Summary
A security flaw in InvoicePlane 1.7.0 allows attackers to inject malicious code into invoices, which can be executed by other administrators. This could lead to unauthorized access or data theft. Update to version 1.7.1 to fix the issue.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| invoiceplane | invoiceplane | <= 1.7.1 | – |
Original title
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in InvoicePlane 1.7.0 via the Invoice Nu...
Original description
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in InvoicePlane 1.7.0 via the Invoice Number field. An authenticated administrator can inject malicious JavaScript that executes when any administrator views the affected invoice or visits the dashboard. Version 1.7.1 patches the issue.
nvd CVSS3.1
4.8
Vulnerability type
CWE-79
Cross-site Scripting (XSS)
Published: 18 Feb 2026 · Updated: 11 Mar 2026 · First seen: 6 Mar 2026