CVE-2025-67082: Invoiceplane

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

An SQL injection vulnerability in InvoicePlane through 1.6.3 has been identified in "maxQuantity" and "minQuantity" parameters when generating a report. An authenticated attacker can exploit this issue via error-based SQL injection, allowing for the extraction of arbitrary data from the database. The vulnerability arises from insufficient sanitizing of single quotes.

Affected products

• Invoiceplane Invoiceplane: before 1.6.4 (fixed in 1.6.4)

Published 2026-01-15. Last modified 2026-06-17.