Cross-Site Scripting Vulnerability in InvoicePlane by InvoicePlane
CVE-2018-12255

6.1MEDIUM

Key Information:

Vendor

Invoiceplane

Status
Invoiceplane
Vendor
CVE Published:
3 July 2018

What is CVE-2018-12255?

A Cross-Site Scripting (XSS) vulnerability exists in InvoicePlane 1.5.10, which can be exploited through the 'Quote PDF Password (Optional)' field. Attackers can manipulate this input to inject malicious scripts, potentially compromising the security of users who view the affected PDF documents. This vulnerability underscores the importance of robust input validation mechanisms in web applications.

References

https://github.com/V33RU/Invoice-Plane-XSS
x_refsource_MISC
https://development.invoiceplane.com/browse/IP-707
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.