InvoicePlane 1.7.0 invoice_number cross site scripting

Summaryinfo

A vulnerability described as problematic has been identified in InvoicePlane 1.7.0. This affects an unknown part. The manipulation of the argument invoice_number results in cross site scripting. This vulnerability is reported as CVE-2026-24744. The attack can be launched remotely. No exploit exists. A patch should be applied to remediate this issue.

Detailsinfo

A vulnerability was found in InvoicePlane 1.7.0. It has been classified as problematic. Affected is an unknown code block. The manipulation of the argument invoice_number with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. CVE summarizes:

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the Edit Invoices functions of InvoicePlane version 1.7.0. When editing invoices, the application does not validate user input at the `invoice_number` parameter. Although administrator privileges are required to exploit it, this is still considered a critical vulnerability as it can cause actions such as unauthorized modification of application data, creation of persistent backdoors through stored malicious scripts, and full compromise of the application's integrity. Version 1.7.1 patches the issue.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-24744 since 01/26/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. Additional levels of successful authentication are required for exploitation. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1059.007 by the MITRE ATT&CK project.

Applying the patch 93622f2df88a860d89bfee56012cabb2942061d6 is able to eliminate this problem. The bugfix is ready for download at github.com.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• InvoicePlane

Version

• 1.7.0

License

• open-source

Website

• Product: https://github.com/InvoicePlane/InvoicePlane/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion