SQL Injection Vulnerability in InvoiceShelf by InvoiceShelf

CVE-2026-55386

What is CVE-2026-55386?

InvoiceShelf, an open-source web and mobile application designed to manage expenses and generate invoices, is susceptible to SQL injection prior to version 2.4.0. This vulnerability arises when the application improperly handles the 'orderByField' query parameter within its filtering mechanism, allowing attackers to inject unauthorized SQL expressions. Consequently, it is possible for malicious users to manipulate database queries, leading to the potential exposure of sensitive information stored in the application's database. A fix has been implemented in version 2.4.0 to mitigate this issue.

References