CVE-2026-54790Medium· 6.0▾ SunlitInvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores an administrator-controlled custom_field_table value without validating it against the allowed custom…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores an administrator-controlled custom_field_table value without validating it against the allowed custom-field table names. Mdl_custom_fields::used() later concatenates that stored value into the FROM table and WHERE column identifier positions, so opening the custom-field edit form executes a second-order SQL injection. The injection can query arbitrary schema data and can cause application errors or denial of service. This issue is fixed in version 1.7.2.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-33639High· 7.2InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments
CVE-2026-85290Medium· 5.3InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments
CVE-2026-39372Medium· 4.9InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments
CVE-2026-85274Medium· 6.5InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments
CVE-2026-85291Medium· 6.5InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments
CVE-2026-85292Medium· 4.8InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments