Stored XSS Vulnerability in InvoicePlane Affects Invoice Management Systems

CVE-2026-24743

What is CVE-2026-24743?

InvoicePlane, which facilitates the management of invoices, clients, and payments, has a Stored Cross-Site Scripting (XSS) vulnerability in its Upload Invoice Logo feature. This function allows administrators to upload SVG files, which can be exploited to inject malicious scripts. While it requires administrator privileges to exploit, successful attacks may lead to unauthorized data alterations, the creation of persistent backdoors, and the overall compromise of the application's integrity. Users are urged to upgrade to version 1.7.1, where this vulnerability has been addressed.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References