PT-2026-3026 · Unknown · Invoiceplane

Published 2026-01-15 · Updated 2026-01-17 · CVE-2025-67082

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions InvoicePlane versions through 1.6.3

Description An SQL injection issue exists in InvoicePlane. The problem is found in the maxQuantity and minQuantity parameters when generating a report. A user with valid credentials can exploit this by using error-based SQL injection to retrieve data from the database. This is due to inadequate sanitization of single quotes.

Recommendations Update InvoicePlane to a version later than 1.6.3.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-67082

Affected Products

Invoiceplane

References · 5

• 🔥 https://helx.io/blog/advisory-invoice-plane · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-67082 · Security Note
• https://osv.dev/vulnerability/CVE-2025-67082 · Vendor Advisory
• https://github.com/InvoicePlane/InvoicePlane · Note
• https://twitter.com/CVEnew/status/2012490390490747074 · Twitter Post