Stored XSS Vulnerability in InvoicePlane by InvoicePlane

CVE-2026-24744

What is CVE-2026-24744?

InvoicePlane, a self-hosted open-source application designed for managing invoices, clients, and payments, harbors a Stored Cross-Site Scripting (XSS) vulnerability in its Edit Invoices functionality. Specifically, the vulnerability arises from inadequate input validation for the 'invoice_number' parameter within version 1.7.0. Although this issue requires administrator privileges to be exploited, it poses a significant risk by enabling potential unauthorized modifications to application data. Additionally, attackers could deploy persistent backdoors via stored malicious scripts, jeopardizing the application's overall integrity. The issue has been addressed in version 1.7.1.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References