CVE-2026-25595

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability exists in InvoicePlane 1.7.0 via the Invoice Number field. An authenticated administrator can inject malicious JavaScript that executes when any administrator views the affected invoice or visits the dashboard. Version 1.7.1 patches the issue.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Feb 18, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-255964.8InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vuln CVE-2026-255975.3PrestaShop is an open source e-commerce web application. Prior to 8.2.4 and 9.0.3, there is a time-based user enumeration vulnerability in t CVE-2026-255985.3Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. Prior to 2.14.2, a security vulnerability has bee CVE-2026-255996.3Missing authentication and clear‑text transmission of data from the heat pumps to the control server, combined with the absence of input val CVE-2026-25606.3A vulnerability has been found in kalcaddle kodbox up to 1.64.05. The impacted element is the function run of the file plugins/fileThumb/lib CVE-2026-256006.4The PDBM application relies on a static, hard‑coded secret embedded in the PDBM.exe executable. This secret is used by the application’s e CVE-2026-256016.7A vulnerability was identified in MEPIS RM, an industrial software product developed by Metronik. The application contained a hardcoded cryp CVE-2026-256022.3Insufficient Verification of Data Authenticity in the feedback function of Mesalvo MEONA (MEONA Client and MEONA Server). The MEONA Client t CVE-2026-256036.6Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Linksys MR9600, Linksys MX4200 allows that c CVE-2026-256045.4In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual insta CVE-2026-256057.1A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7). The affected application performs file deletion without prop CVE-2026-256068.7A SQL injection vulnerability has been identified in STER. Improper neutralization of input provided by user into multiple Search Filters al