{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-14T16:37:06.430","vulnerabilities":[{"cve":{"id":"CVE-2026-24745","sourceIdentifier":"security-advisories@github.com","published":"2026-02-18T23:16:19.407","lastModified":"2026-02-20T18:45:21.533","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting (XSS) vulnerability occurs in the upload Login Logo functions of InvoicePlane version 1.7.0. In the Upload Login Logo, the application allows uploading svg files. Although administrator privileges are required to exploit it, this is still considered a critical vulnerability as it can cause actions such as unauthorized modification of application data, creation of persistent backdoors through stored malicious scripts, and full compromise of the application's integrity. Version 1.7.1 patches the issue."},{"lang":"es","value":"InvoicePlane es una aplicación de código abierto autoalojada para gestionar facturas, clientes y pagos. Una vulnerabilidad de cross-site scripting (XSS) almacenado ocurre en las funciones de carga del logotipo de inicio de sesión de InvoicePlane versión 1.7.0. En la carga del logotipo de inicio de sesión, la aplicación permite cargar archivos svg. Aunque se requieren privilegios de administrador para explotarla, esto todavía se considera una vulnerabilidad crítica ya que puede causar acciones como modificación no autorizada de datos de la aplicación, creación de puertas traseras persistentes a través de scripts maliciosos almacenados y compromiso total de la integridad de la aplicación. La versión 1.7.1 corrige el problema."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:L","baseScore":5.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":0.9,"impactScore":4.7},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":1.7,"impactScore":5.3}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:invoiceplane:invoiceplane:1.7.0:-:*:*:*:*:*:*","matchCriteriaId":"95F739B4-399F-459D-BF16-5E225A268320"}]}]}],"references":[{"url":"https://github.com/InvoicePlane/InvoicePlane/commit/93622f2df88a860d89bfee56012cabb2942061d6","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-r9rq-f946-6x54","source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"]}]}}]}