CVE-2026-55386
InvoiceShelf ORDER BY SQL injection through orderByField
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf passes the authenticated user's orderByField query parameter into Laravel orderBy calls in Invoice::scopeApplyFilters without restricting the value to column identifiers. A crafted SQL expression can therefore enter the ORDER BY clause across invoice and other list endpoints, enabling boolean-based blind extraction of database information. This issue is fixed in version 2.4.0.
| CWE | CWE-89 |
| Vendor | invoiceshelf |
| Product | invoiceshelf |
| Published | Oct 14, 2026 |
| Last Updated | Oct 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for invoiceshelf invoiceshelf
Be the first to know when new unknown vulnerabilities affecting invoiceshelf invoiceshelf are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
InvoiceShelf / InvoiceShelf
< 2.4.0
References
github.com: https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-cp8p-jcqf-j39c github.com: https://github.com/InvoiceShelf/InvoiceShelf/pull/663 github.com: https://github.com/InvoiceShelf/InvoiceShelf/commit/e92b08ef6af7d0d0cd5183df81f795f7fbf4f4fc github.com: https://github.com/InvoiceShelf/InvoiceShelf/releases/tag/2.4.0