CVE-2019-7223

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoice_password parameter, aka the "PDF password" field to the "Create Invoice" option. The XSS payload is rendered at an index.php/invoices/view/## URI. NOTE: this is different from CVE-2018-12255.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Mar 21, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-72258.8The ABB HMI components implement hidden administrative accounts that are used during the provisioning phase of the HMI interface. These cred CVE-2019-72268.8The ABB IDAL HTTP server CGI interface contains a URL that allows an unauthenticated attacker to bypass authentication and gain access to pr CVE-2019-72277.3In the ABB IDAL FTP server, an authenticated attacker can traverse to arbitrary directories on the hard disk with "CWD ../" and then use the CVE-2019-72288.8The ABB IDAL HTTP server mishandles format strings in a username or cookie during the authentication process. Attempting to authenticate wit CVE-2019-72298.3The ABB CP635 HMI uses two different transmission methods to upgrade its firmware and its software components: "Utilization of USB/SD Card t CVE-2019-72308.8The ABB IDAL FTP server mishandles format strings in a username during the authentication process. Attempting to authenticate with the usern CVE-2019-72315.7The ABB IDAL FTP server is vulnerable to a buffer overflow when a long string is sent by an authenticated attacker. This overflow is handled CVE-2019-72328.8The ABB IDAL HTTP server is vulnerable to a buffer overflow when a long Host header is sent in a web request. The Host header value overflow CVE-2019-72338.8In libdoc through 2019-01-28, doc2text in catdoc.c has a NULL pointer dereference.CVE-2019-72349.1An issue was discovered in idreamsoft iCMS 7.0.13. admincp.php?app=apps&do=save allows directory traversal via _app=/../ to begin the proces CVE-2019-72357.5An issue was discovered in idreamsoft iCMS 7.0.13. admincp.php?app=apps&do=save allows directory traversal via _app=/../ to designate an arb CVE-2019-72367.5An issue was discovered in idreamsoft iCMS 7.0.13. editor/editor.admincp.php allows admincp.php?app=editor&do=fileManager dir=../ Directory