SolidInvoice vulnerabilities
6 published CVEs name SolidInvoice among the affected products.
- 6Published CVEs6 of them scored
- 6Last 12 monthspublished in the last year
- 0Critical3 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-61688
SolidInvoice allows cross-user access to API token request history via writable DataGrid LiveComponent props
SolidInvoice · SolidInvoice
Medium6.5 - CVE-2026-61614
SolidInvoice's long-lived API tokens accepted as URL query parameters, exposing credentials in server logs and browser history
SolidInvoice · SolidInvoice
Medium5.9 - CVE-2026-61608
SolidInvoice's user invitation tokens have no expiry, allowing indefinite unauthorized company access via leaked or old invitation links
SolidInvoice · SolidInvoice
Medium6.8 - CVE-2026-61686
SolidInvoice: PHP unserialize() called on client-controlled data in DataGrid LiveComponent context prop
SolidInvoice · SolidInvoice
High7.5 - CVE-2026-46489
SolidInvoice: Unrestricted file upload with no MIME validation allows stored XSS via malicious SVG logo
SolidInvoice · SolidInvoice
High8.1 - CVE-2026-46622
SolidInvoice: API tokens stored as plaintext in the database allowing full credential compromise on database breach
SolidInvoice · SolidInvoice
High8.1