Solidinvoice
Approved changes feed: RSS · Atom
cpe:2.3:a:solidinvoice:solidinvoice:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Solidinvoice (f3e93c18-d6cf-5f4f-964c-61043dfc6695) |
|---|---|
| Product | Solidinvoice (6d416ec4-67b9-5ffc-bb7f-d6e34ff770c8) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:composer/solidinvoice/solidinvoice |
purl2cpe | 2026-06-01 10:17:49.433360 |
pkg:github/solidinvoice/solidinvoice |
purl2cpe | 2026-06-01 10:17:49.433363 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-46622 |
vulnerable | 2026-07-29 00:54:59.083341 |
SolidInvoice: API tokens stored as plaintext in the database allowing full credential compromise on database breach
HIGH (8.1)
SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, API tokens used to authenticate all REST API requests are stored as plaintext strings in the api_tokens database table. Any attacker who obtains read access to the database — through SQL injection, a leaked backup, a misconfigured replica, or insider access — immediately obtains all API credentials for every user with no further effort. This issue has been patched in version 2.3.17.
Published: 2026-06-11T18:55:23.915Z
Updated: 2026-06-15T19:28:42.236Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-46489 |
vulnerable | 2026-07-29 00:54:58.974149 |
SolidInvoice: Unrestricted file upload with no MIME validation allows stored XSS via malicious SVG logo
HIGH (8.1)
SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, the company logo upload feature accepts any file type without validation. An authenticated administrator can upload an SVG file containing embedded JavaScript. This script is base64-encoded and injected unescaped into every page of the application, causing stored cross-site scripting (XSS) that executes in every authenticated user's browser. This issue has been patched in version 2.3.17.
Published: 2026-06-11T18:55:44.418Z
Updated: 2026-06-12T10:31:29.970Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-9171 |
vulnerable | 2026-06-08 07:45:21.835510 |
SolidInvoice Clients clients cross site scripting
LOW (3.5)
A security flaw has been discovered in SolidInvoice up to 2.4.0. The impacted element is an unknown function of the file /clients of the component Clients Module. Performing manipulation of the argument Name results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2025-08-19T22:32:05.818Z
Updated: 2025-08-20T15:16:20.030Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-9170 |
vulnerable | 2026-06-08 07:45:21.835088 |
SolidInvoice Tax Rates rates cross site scripting
LOW (3.5)
A vulnerability was identified in SolidInvoice up to 2.4.0. The affected element is an unknown function of the file /tax/rates of the component Tax Rates Module. Such manipulation of the argument Name leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2025-08-19T22:02:05.880Z
Updated: 2025-08-20T15:16:27.386Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-9169 |
vulnerable | 2026-06-08 07:45:21.834581 |
SolidInvoice Quote quotes cross site scripting
LOW (3.5)
A vulnerability was determined in SolidInvoice up to 2.4.0. Impacted is an unknown function of the file /quotes of the component Quote Module. This manipulation of the argument Name causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2025-08-19T21:32:06.661Z
Updated: 2025-08-20T15:16:35.580Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-9168 |
vulnerable | 2026-06-08 07:45:21.834073 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-9167 |
vulnerable | 2026-06-08 07:45:21.833577 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.