InvoicePlane vulnerabilities

InvoicePlane version 1.4.10 is vulnerable to an Arbitrary File Upload, allowing an authenticated user to upload a malicious file to the webserver. An attacker can upload a script that can compromise the webserver.

InvoicePlane through 1.6.3 contains a file upload vulnerability allowing authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Execution (RCE).

In InvoicePlane 1.5.11, a misconfigured web server allows an unauthenticated attacker to list directories and download files that should be private via directory traversal.

InvoicePlane 1.5.11 lacks rate-limiting for password reset and uses a weak, predictable token generation mechanism.

InvoicePlane 1.5.11 discloses the full path of the file upload directory when using the upload feature.