These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-85293 is a medium-severity vulnerability in InvoicePlane, a self-hosted open-source application for managing invoices, clients, and payments. The issue, fixed in version 1.7.2, allows an administrator with editing privileges to store malicious input in the client_email field, which can lead to JavaScript execution when another authenticated administrator views the related mailer page.
CVE-2026-85292 is a medium-severity vulnerability in InvoicePlane, a self-hosted open-source application for managing invoices, clients, and payments. The issue arises from the use of PHP's loose inequality operator in the User_Controller, which can lead to authentication or authorization bypass under non-standard session backend configurations. This vulnerability is fixed in version 1.7.2.
CVE-2026-85291 is a vulnerability in InvoicePlane, a self-hosted open source application for managing invoices, clients, and payments. An authenticated secondary administrator can target the primary administrator account and replace its password without knowing the current password, potentially gaining access to its data and privileges. This issue is fixed in version 1.7.2.
CVE-2026-85290 is a vulnerability in InvoicePlane, a self-hosted open source application for managing invoices, clients, and payments. Prior to version 1.7.2, the application's Cron::recur() method writes an invalid cron key from the URL path directly to the application log without neutralizing CRLF characters. This allows an unauthenticated requester to place forged log lines into the audit trail by supp [truncated]
CVE-2026-85289 debrief based on the supplied source corpus. The CVE record was published on 2026-09-25T16:17:28.157Z and has not been modified since then. This CSRF vulnerability in InvoicePlane allows attackers to delete financial records and other application data. Administrators of InvoicePlane installations should verify their version and apply the patch to prevent unauthorized deletion of sensitive d [truncated]
CVE-2026-85274 is a vulnerability in InvoicePlane, a self-hosted open-source application for managing invoices, clients, and payments. An attacker can exploit this vulnerability to stop recurring invoices by making a GET request to /invoices/recurring/stop/{id} without a CSRF token, potentially causing financial loss. The vulnerability allows attackers to target multiple identifiers to interrupt recurring [truncated]
CVE-2026-54790 is a SQL injection vulnerability in InvoicePlane, a self-hosted open-source application for managing invoices, clients, and payments. The vulnerability exists in versions prior to 1.7.2 and allows an attacker to execute a second-order SQL injection attack by manipulating the custom_field_table value. This can lead to arbitrary schema data queries and application errors or denial of service.
CVE-2026-50547 is a local file inclusion vulnerability in InvoicePlane, a self-hosted open-source application for managing invoices, clients, and payments. The vulnerability exists in the Invoices::generate_xml() method, which appends a database-derived xml_id to the XMLconfigs helper directory and includes the resulting PHP path without validating the identifier. This allows a low-privileged attacker who [truncated]
CVE-2026-49850 is a high-severity vulnerability in InvoicePlane, a self-hosted open-source application for managing invoices, clients, and payments. An attacker can exploit this vulnerability by tricking an authenticated administrator into loading malicious content, allowing the deletion of invoice or invoice tax records without the administrator's intent. This issue was fixed in version 1.7.2.
CVE-2026-39372 is a vulnerability in InvoicePlane, a self-hosted open source application for managing invoices, clients, and payments. The vulnerability allows for the disclosure of private location and device details across users due to the storage and serving of uploaded image attachments without stripping EXIF metadata. This issue was fixed in version 1.7.2.
CVE-2026-39353 is a critical vulnerability in InvoicePlane, a self-hosted open-source application for managing invoices, clients, and payments. The vulnerability allows a malicious PHP file to be executed with web-server privileges when a public invoice is rendered. This issue is fixed in version 1.7.2-rc-1. Defenders responsible for managing InvoicePlane installations should assess exposure and apply the [truncated]
InvoicePlane versions prior to 1.7.2 are vulnerable to a schema corruption issue. The application interpolates the administrator-controlled tax_rate_decimal_places setting into an ALTER TABLE statement without strict integer validation, allowing a crafted setting value to add clauses to the schema-changing statement and remove or alter required database columns.