CVE-2026-55386
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create…
- Risk score
- 48/100
- CVSS
- 7.1 v4.0
- Exploit chance (30 days)
- 0.4%
- Published
- 14 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf passes the authenticated user's orderByField query parameter into Laravel orderBy calls in Invoice::scopeApplyFilters without restricting the value to…
- Affected
- See advisory
- Fix
- Upgrade the product to 2.4.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.1 high
References
- https://github.com/InvoiceShelf/InvoiceShelf/commit/e92b08ef6af7d0d0cd5183df81f795f7fbf4f4fc
- https://github.com/InvoiceShelf/InvoiceShelf/pull/663
- https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0
- https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-cp8p-jcqf-j39c
- https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-cp8p-jcqf-j39c
Original description
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf passes the authenticated user's orderByField query parameter into Laravel orderBy calls in Invoice::scopeApplyFilters without restricting the value to column identifiers. A crafted SQL expression can therefore enter the ORDER BY clause across invoice and other list endpoints, enabling boolean-based blind extraction of database information. This issue is fixed in version 2.4.0.
Last activity 14 Oct 2026. Patch Forecast updates every hour.