Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in InvoicePlane 1.7.0 via the Product Unit Name fields. An authenticated administrator can inject malicious JavaScript that executes when any administrator views an invoice containing a product with the malicious unit. Version 1.7.1 patches the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-19 | 1 | Disclosure1 |
| 2026-02-24 | 2 | Disclosure2 |
🚨*CVE* CVE-2026-25596 InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in Invoic… https://www.cve.org/CVERecord?id=CVE-2026-25596 ----- Traducción: CVE-2026-25596 Inv… http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑25596, a stored XSS vulnerability in InvoicePlane, and links to the official CVE record.
CVE-2026-25596 InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in Invoic… https://www.cve.org/CVERecord?id=CVE-2026-25596
Post summary
CVE-2026-25596 is a stored XSS vulnerability in InvoicePlane, with no mention of PoC, exploit, or patch.
CVE-2026-25596 Stored Cross-Site Scripting in InvoicePlane 1.7.0 via Product Unit Name Fields https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25596
Post summary
The text announces a stored XSS vulnerability in InvoicePlane 1.7.0, detailing the affected field and linking to a vulnerability details page.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | invoiceplane | invoiceplane | - | - | - |