CVE-2026-24746

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the Edit Quotes functions of InvoicePlane version 1.7.0. In the Editing Quotes function, the application does not validate user input at the quote_number parameter. Although administrator privileges are required to exploit it, this is still considered a critical vulnerability as it can cause actions such as unauthorized modification of application data, creation of persistent backdoors through stored malicious scripts, and full compromise of the application's integrity. Version 1.7.1 patches the issue.

• CWE-79

• https://github.com/InvoicePlane/InvoicePlane/commit/93622f2df88a860d89bfee56012cabb2942061d6Patch
• https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-73x8-gr6v-vjvjExploit, Mitigation, Vendor Advisory

Published

Feb 18, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-24740Dozzle is a realtime log viewer for docker containers. Prior…9.9
• CVE-2026-24741ConvertXis a self-hosted online file converter. In versions …8.1
• CVE-2026-24742Discourse is an open source discussion platform. In versions…6.5
• CVE-2026-24743InvoicePlane is a self-hosted open source application for ma…7.5
• CVE-2026-24744InvoicePlane is a self-hosted open source application for ma…7.5
• CVE-2026-24745InvoicePlane is a self-hosted open source application for ma…7.5
• CVE-2026-24747PyTorch is a Python package that provides tensor computation…8.8
• CVE-2026-24748Kargo manages and automates the promotion of software artifa…7.2
• CVE-2026-24749The Silverstripe Assets Module is a required component of Si…5.3
• CVE-2026-2475IBM Verify Identity Access Container 11.0 through 11.0.2 and…4.7
• CVE-2026-24750Kiteworks is a private data network (PDN). In Kiteworks Secu…5.4
• CVE-2026-24751Kiteworks is a private data network (PDN). Prior to version …8.2