CVE-2025-67082 SQL injection in n/a

What is CVE-2025-67082?

CVE-2025-67082 is a medium-severity SQL injection vulnerability in n/a, published on 15 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An SQL injection vulnerability in InvoicePlane through 1.6.3 has been identified in "maxQuantity" and "minQuantity" parameters when generating a report. An authenticated attacker can exploit this issue via error-based SQL injection, allowing for the extraction of arbitrary data from the database. The vulnerability arises from insufficient sanitizing of single quotes.

Weakness: CWE-89

Which versions are affected by CVE-2025-67082?

It affects 1 product.

Products include Invoiceplane Invoiceplane.

How do I fix CVE-2025-67082?

No fix has been published for CVE-2025-67082 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2025-67082 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-67082 exists.

Other vulnerabilities in n/a

• CVE-2025-67084 File upload in n/a Critical 9.9
• CVE-2024-56975 File upload in n/a Critical 9.8
• CVE-2026-23491 InvoicePlane has Unauthenticated Path Traversal in Guest Controller Critical 9.3
• CVE-2026-25548 InvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoning Critical 9.1
• CVE-2017-1000238 File upload in n/a High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mfr5-898v-5wmr.