CVE-2008-6524: Cale Dunlap Openinvoice

Medium severity, CVSS 6.5. EPSS: 2% chance of exploitation in the next 30 days.

resetpass.php in openInvoice 0.90 beta and earlier allows remote authenticated users to change the passwords of arbitrary users via a modified uid parameter. NOTE: this can be leveraged with a separate vulnerability in auth.php to modify passwords without authentication.

Affected products

• Cale Dunlap Openinvoice: up to and including 0.90

Published 2009-03-25. Last modified 2026-06-16.