SQL Injection

Every one of the 3 is a mark on the map. Named now: 1 to 3, most at risk first.

1. InvoicePlane permits DDL injection through tax_rate_decimal_placesCVE-2026-33639InvoicePlane · CVSS 7.2 · 0.5% likely

   CWE-89

2. An SQL injection vulnerability in InvoicePlane through 1.6.3 has been identified in "maxQuantity" and "minQuantity" parameters when generating a report. An authenticated attacker…CVE-2025-67082Invoiceplane · CVSS 6.5 · 0.3% likely

   CWE-89

3. InvoicePlane: Second-order SQL injection through the unvalidated custom_field_table field in the Custom Fields moduleCVE-2026-54790InvoicePlane · CVSS 6 · 0.3% likely

   CWE-89

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.