CVE-2026-33639Published
InvoicePlane permits DDL injection through tax_rate_decimal_places
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-33639 · Microsoft / collected KEV context
cve-program · CVE-2026-33639
- https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-34g5-4hfc-g983
- https://github.com/InvoicePlane/InvoicePlane/pull/1481
- https://github.com/InvoicePlane/InvoicePlane/pull/1488
- https://github.com/InvoicePlane/InvoicePlane/commit/8fe41750d7c6fd039ac7353e5311bf4c140c3436
- https://github.com/InvoicePlane/InvoicePlane/commit/efec2d28d574ca616f218d758bd5adaa9a60b3a0
- https://github.com/InvoicePlane/InvoicePlane/commit/fca7792a24de0a749d881cbbe4af6f58e9545d20
- https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.7.2
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.