| Package | Affected versions | Patched versions |
|---|---|---|
| invoiceplane | < 1.6.4 | 1.6.4 |
An SQL injection vulnerability in InvoicePlane through 1.6.3 has been identified in "maxQuantity" and "minQuantity" parameters when generating a report. An authenticated attacker can exploit this issue via error-based SQL injection, allowing for the extraction of arbitrary data from the database. The vulnerability arises from insufficient sanitizing of single quotes.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free