CVE-2021-29023: Invoiceplane

Medium severity, CVSS 5.3. EPSS: 1.2% chance of exploitation in the next 30 days.

InvoicePlane 1.5.11 doesn't have any rate-limiting for password reset and the reset token is generated using a weak mechanism that is predictable.

Affected products

• Invoiceplane Invoiceplane: version 1.5.11 only

Published 2021-05-17. Last modified 2026-07-29.