CVE-2026-25595

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in InvoicePlane 1.7.0 via the Invoice Number field. An authenticated administrator can inject malicious JavaScript that executes when any administrator views the affected invoice or visits the dashboard. Version 1.7.1 patches the issue.

• CWE-79

• https://github.com/InvoicePlane/InvoicePlane/commit/93622f2df88a860d89bfee56012cabb2942061d6Patch
• https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-xxvr-2564-6jg6Exploit, Vendor Advisory

Published

Feb 18, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-2559The Post SMTP plugin for WordPress is vulnerable to unauthor…5.3
• CVE-2026-25590The GLPI Inventory Plugin handles network discovery, invento…6.1
• CVE-2026-25591New API is a large language mode (LLM) gateway and artificia…6.5
• CVE-2026-25592Semantic Kernel is an SDK used to build, orchestrate, and de…9.9
• CVE-2026-25593OpenClaw is a personal AI assistant. Prior to 2026.1.20, an …8.4
• CVE-2026-25594InvoicePlane is a self-hosted open source application for ma…4.8
• CVE-2026-25596InvoicePlane is a self-hosted open source application for ma…4.8
• CVE-2026-25597PrestaShop is an open source e-commerce web application. Pri…5.3
• CVE-2026-25598Harden-Runner is a CI/CD security agent that works like an E…5.3
• CVE-2026-25599Missing authentication and clear‑text transmission of data f…6.3
• CVE-2026-2560A vulnerability has been found in kalcaddle kodbox up to 1.6…6.3
• CVE-2026-25600The PDBM application relies on a static, hard‑coded secret e…6.4