CVE-2026-24744

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the Edit Invoices functions of InvoicePlane version 1.7.0. When editing invoices, the application does not validate user input at the `invoice_number` parameter. Although administrator privileges are required to exploit it, this is still considered a critical vulnerability as it can cause actions such as unauthorized modification of application data, creation of persistent backdoors through stored malicious scripts, and full compromise of the application's integrity. Version 1.7.1 patches the issue.

• CWE-79

• https://github.com/InvoicePlane/InvoicePlane/commit/93622f2df88a860d89bfee56012cabb2942061d6Patch
• https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-5mxx-553h-m62wExploit, Mitigation, Vendor Advisory

Published

Feb 18, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-24739Symfony is a PHP framework for web and console applications …6.3
• CVE-2026-2474Crypt::URandom versions from 0.41 before 0.55 for Perl is vu…7.5
• CVE-2026-24740Dozzle is a realtime log viewer for docker containers. Prior…9.9
• CVE-2026-24741ConvertXis a self-hosted online file converter. In versions …8.1
• CVE-2026-24742Discourse is an open source discussion platform. In versions…6.5
• CVE-2026-24743InvoicePlane is a self-hosted open source application for ma…7.5
• CVE-2026-24745InvoicePlane is a self-hosted open source application for ma…7.5
• CVE-2026-24746InvoicePlane is a self-hosted open source application for ma…7.5
• CVE-2026-24747PyTorch is a Python package that provides tensor computation…8.8
• CVE-2026-24748Kargo manages and automates the promotion of software artifa…7.2
• CVE-2026-24749The Silverstripe Assets Module is a required component of Si…5.3
• CVE-2026-2475IBM Verify Identity Access Container 11.0 through 11.0.2 and…4.7