CVE Feed

    Dashboard / CVE / CVE-2026-55386

    CVE-2026-55386

    InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf passes the authenticated user's orderByField query parameter into Laravel orderBy calls in Invoice::scopeApplyFilters without restricting the value to column identifiers. A crafted SQL expression can therefore enter the ORDER BY clause across invoice and other list endpoints, enabling boolean-based blind extraction of database information. This issue is fixed in version 2.4.0.

    Published:Oct 14, 2026
    Last Modified:Oct 17, 2026
    EPS:Oct 14, 2026
    EPSS Score:0.00363
    CVSS Score:7.1

    Affected Products

    Vendor
    Invoiceshelf
    Product
    Invoiceshelf

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-122158 (CVSS 2) — A security flaw has been discovered in InvoiceShelf up to 2.4.3/3.0.0-alpha.3. Affected by this issue is the f…
    CVE-2026-55382 (CVSS 7.6) — InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional in…
    CVE-2026-55385 (CVSS 6.8) — InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional in…
    CVE-2026-55381 (CVSS 7.1) — InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional in…
    CVE-2026-55383 (CVSS 8.2) — InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional in…
    CVE-2026-55387 (CVSS 7.2) — InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional in…
    CVE-2026-55384 (CVSS 5.3) — InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional in…
    CVE-2026-55610 (CVSS 8.7) — InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional in…
    CVE-2026-34367 (CVSS 7.6) — InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional in…
    CVE-2026-34366 (CVSS 7.6) — InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional in…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High