CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2019-7223

InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoice_password parameter, aka the "PDF password" field to the "Create Invoice" option. The XSS payload is rendered at an index.php/invoices/view/## URI. NOTE: this is different from CVE-2018-12255.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.003

EPSS Ranking 51.4%

CVSS Severity

CVSS v3 Score 5.4

CVSS v2 Score 3.5

References

Products affected by CVE-2019-7223

Invoiceplane » Invoiceplane » Version: 1.5.0

cpe:2.3:a:invoiceplane:invoiceplane:1.5.0
Invoiceplane » Invoiceplane » Version: 1.5.1

cpe:2.3:a:invoiceplane:invoiceplane:1.5.1
Invoiceplane » Invoiceplane » Version: 1.5.2

cpe:2.3:a:invoiceplane:invoiceplane:1.5.2
Invoiceplane » Invoiceplane » Version: 1.5.3

cpe:2.3:a:invoiceplane:invoiceplane:1.5.3
Invoiceplane » Invoiceplane » Version: 1.5.4

cpe:2.3:a:invoiceplane:invoiceplane:1.5.4
Invoiceplane » Invoiceplane » Version: 1.5.5

cpe:2.3:a:invoiceplane:invoiceplane:1.5.5
Invoiceplane » Invoiceplane » Version: 1.5.6

cpe:2.3:a:invoiceplane:invoiceplane:1.5.6
Invoiceplane » Invoiceplane » Version: 1.5.7

cpe:2.3:a:invoiceplane:invoiceplane:1.5.7
Invoiceplane » Invoiceplane » Version: 1.5.8

cpe:2.3:a:invoiceplane:invoiceplane:1.5.8
Invoiceplane » Invoiceplane » Version: 1.5.9

cpe:2.3:a:invoiceplane:invoiceplane:1.5.9

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2019-7223

Products

Pricing

Contact Us