Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the Edit Invoices functions of InvoicePlane version 1.7.0. When editing invoices, the application does not validate user input at the `invoice_number` parameter. Although administrator privileges are required to exploit it, this is still considered a critical vulnerability as it can cause actions such as unauthorized modification of application data, creation of persistent backdoors through stored malicious scripts, and full compromise of the application's integrity. Version 1.7.1 patches the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-02-18 | 1 | General1 |
| 2026-02-19 | 1 | Disclosure1 |
CVE-2026-24744 Stored XSS Vulnerability in InvoicePlane 1.7.0 via Invoice Number Parameter https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-24744
Post summary
A stored cross‑site scripting vulnerability (CVE‑2026‑24744) exists in InvoicePlane 1.7.0 triggered through the invoice number parameter, with no PoC, exploit code, or patch discussed.
CVE-2026-24744 InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the Ed… https://www.cve.org/CVERecord?id=CVE-2026-24744
Post summary
CVE-2026-24744 is identified as a stored XSS vulnerability in InvoicePlane, but the snippet provides no information on exploitation, PoC, or patches.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | invoiceplane | invoiceplane | 1.7.0 | - | - |