VYPR
← All advisories
Unrated severityOSV Advisory· Published Jan 15, 2026· Updated Jan 15, 2026

CVE-2025-67082

CVE-2025-67082

Description

An SQL injection vulnerability in InvoicePlane through 1.6.3 has been identified in "maxQuantity" and "minQuantity" parameters when generating a report. An authenticated attacker can exploit this issue via error-based SQL injection, allowing for the extraction of arbitrary data from the database. The vulnerability arises from insufficient sanitizing of single quotes.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Invoiceplane/InvoiceplaneOSV2 versions
    0.9beta, v1.0.0, v1.0.1, …+ 1 more
    • (no CPE)range: 0.9beta, v1.0.0, v1.0.1, …
    • (no CPE)range: <=1.6.3

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.