CVE-2026-55386CWE-89sql-injection

CVE-2026-55386

published October 15, 2026

CVSS
7.1
EPSS
0%
Percentile
28.9
In the wild
Unconfirmed
What it is

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf passes the authenticated user's orderByField query parameter into Laravel orderBy calls in Invoice::scopeApplyFilters without restricting the value to column identifiers. A crafted SQL expression can therefore enter the ORDER BY clause across invoice and other list endpoints, enabling boolean-based blind extraction of database information. This issue is fixed in version 2.4.0.

The record
Technical detail
CVSS
7.1 · NONE
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00363 · 28.9th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-10-15T00:17Z
References (5)
https://github.com/InvoiceShelf/InvoiceShelf/commit/e92b08ef6af7d0d0cd5183df81f795f7fbf4f4fc · [email protected]https://github.com/InvoiceShelf/InvoiceShelf/pull/663 · [email protected]https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0 · [email protected]https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-cp8p-jcqf-j39c · [email protected]https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-cp8p-jcqf-j39c · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 16 OCT 03:30Z
    EPSS moved — → 0%
    epss
  • 14 OCT 19:18Z
    InvoiceShelf ORDER BY SQL injection through orderByField
    cvelistv5
  • 14 OCT 19:18Z
    InvoiceShelf ORDER BY SQL injection through orderByField
    cvelistv5