PT-2026-3026 · Unknown · Invoiceplane

Publicado 2026-01-15 · Atualizado 2026-01-17 · CVE-2025-67082

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions InvoicePlane versions through 1.6.3

Description An SQL injection issue exists in InvoicePlane. The problem is found in the maxQuantity and minQuantity parameters when generating a report. A user with valid credentials can exploit this by using error-based SQL injection to retrieve data from the database. This is due to inadequate sanitization of single quotes.

Recommendations Update InvoicePlane to a version later than 1.6.3.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2025-67082

Produtos afetados

Invoiceplane

Referências · 5

• 🔥 https://helx.io/blog/advisory-invoice-plane · Exploit
• https://github.com/InvoicePlane/InvoicePlane · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-67082 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-67082 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2012490390490747074 · Publicação no Twitter