VYPR
← All advisories
Medium severity6.5OSV Advisory· Published Jan 15, 2026· Updated Jun 17, 2026

CVE-2025-67082

CVE-2025-67082

Description

An SQL injection vulnerability in InvoicePlane through 1.6.3 has been identified in "maxQuantity" and "minQuantity" parameters when generating a report. An authenticated attacker can exploit this issue via error-based SQL injection, allowing for the extraction of arbitrary data from the database. The vulnerability arises from insufficient sanitizing of single quotes.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Invoiceplane/InvoiceplaneOSV3 versions
    0.9beta, v1.0.0, v1.0.1, …+ 2 more
    • (no CPE)range: 0.9beta, v1.0.0, v1.0.1, …
    • cpe:2.3:a:invoiceplane:invoiceplane:*:*:*:*:*:*:*:*range: <1.6.4
    • (no CPE)range: <=1.6.3

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.