These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
InvoiceShelf, an open-source web and mobile app for expense tracking and invoicing, had a Server-Side Request Forgery (SSRF) vulnerability prior to version 2.4.0. The issue was due to the unvalidated 'gotenberg_host' setting in the PDF configuration, which allowed an owner to send HTTP requests to internal services or cloud metadata endpoints. This could lead to exposure of sensitive information, includin [truncated]
An InvoiceShelf vulnerability allows an authenticated staff user to read, modify, or delete notes from another company due to missing company scope checks in the NotePolicy. This issue is fixed in version 2.4.0. The vulnerability arises from the NotesController::show, NotesController::update, and NotesController::destroy methods not properly checking the company_id of the target note, allowing unauthorize [truncated]
An InvoiceShelf vulnerability allows authenticated users to read and tamper with estimates from other companies by exploiting an IDOR in the estimate-to-invoice conversion feature. This issue arises from insufficient authorization in the ConvertEstimateController, enabling an authenticated user with create-invoice ability to access and modify estimates from other companies. The vulnerability affects Invoi [truncated]
InvoiceShelf, an open-source web and mobile app for expense tracking and invoicing, had a vulnerability prior to version 2.4.0. The issue allowed for cross-company invoice disclosure due to a token type confusion in the EmailLog functionality. Specifically, tokens issued for one document type could be used to disclose documents of a different type if their numeric identifiers collided. Additionally, expir [truncated]
InvoiceShelf, an open-source web and mobile app for expense tracking and invoicing, has a vulnerability in its bulk-delete request validation. The issue allows an authenticated user to delete cross-company records by submitting identifiers from another company. This is possible because the validation checks for record existence but not for tenant ownership, specifically the company_id. The vulnerability a [truncated]
InvoiceShelf, an open-source web and mobile app for expense tracking and invoicing, had a SQL injection vulnerability prior to version 2.4.0. The issue allowed an authenticated user to inject malicious SQL through the orderByField query parameter in list endpoints, enabling extraction of database information. This vulnerability could lead to data breaches and service disruption. Defenders should assess an [truncated]
InvoiceShelf, an open-source web and mobile app for expense tracking and invoicing, had a vulnerability prior to version 2.4.0 where it accepted client-supplied document totals without verification. This allowed an authenticated user to manipulate financial totals in invoices, estimates, and recurring invoices, potentially causing discrepancies between stored document totals and item prices and quantities.
CVE-2026-34367 is a Server-Side Request Forgery (SSRF) vulnerability in InvoiceShelf, an open-source web & mobile app for expense tracking and invoicing. The vulnerability exists in the Invoice PDF generation module. User-supplied HTML in the invoice Notes field is passed unsanitized to the Dompdf rendering library, which can fetch remote resources referenced in the markup. This can be triggered via the P [truncated]
A Server-Side Request Forgery (SSRF) vulnerability exists in InvoiceShelf, an open-source web & mobile app, prior to version 2.2.0. The vulnerability is located in the Payment receipt PDF generation module. User-supplied HTML in the payment Notes field is passed unsanitised to the Dompdf rendering library, which can fetch remote resources referenced in the markup. This issue allows for SSRF attacks direct [truncated]
A Server-Side Request Forgery (SSRF) vulnerability exists in InvoiceShelf, an open-source web & mobile app, prior to version 2.2.0. The vulnerability is located in the Estimate PDF generation module. User-supplied HTML in the estimate Notes field is passed unsanitized to the Dompdf rendering library, which can fetch remote resources referenced in the markup. This issue can be exploited directly via the PD [truncated]
