InvoiceShelf vulnerabilities
We track 9 vulnerabilities in InvoiceShelf products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on October 14, 2026.
Latest InvoiceShelf vulnerabilities
- 7.2 High severity
InvoiceShelf: Improper Access Control
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. In version 2.3.3 and earlier, InvoiceShelf bulk-delete request validation accepts record identifiers without consistently bindin
- 7.1 High severity
InvoiceShelf: Improper Neutralization of Special Elements used in an SQL Command
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf passes the authenticated user's orderByField query parameter into Laravel orderBy calls in
- 8.2 High severity
InvoiceShelf: Improper Authorization
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf public customer invoice, estimate, and payment routes use an EmailLog token's numeric maila
- 7.6 High severity
InvoiceShelf: Authorization Bypass Through User-Controlled Key
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf NotesController::show, NotesController::update, and NotesController::destroy authorize only
- 7.1 High severity
InvoiceShelf: Authorization Bypass Through User-Controlled Key
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, POST /api/v1/estimates/{estimate}/convert-to-invoice in ConvertEstimateController authorizes only the ca
- 8.7 High severity
InvoiceShelf: Authorization Bypass Through User-Controlled Key
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.1, in InvoiceShelf's multi-company installations, any user who is an Owner of one company can read and over
- 8.7 High severity
InvoiceShelf: Server-Side Request Forgery
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.2.0, a Server-Side Request Forgery (SSRF) vulnerability exists in the Invoice PDF generation module. User-sup
- 8.1 High severity
InvoiceShelf: Server-Side Request Forgery
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.2.0, a Server-Side Request Forgery (SSRF) vulnerability exists in the Payment receipt PDF generation module.
- 8.1 High severity
InvoiceShelf: Server-Side Request Forgery
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.2.0, a Server-Side Request Forgery (SSRF) vulnerability exists in the Estimate PDF generation module. User-su