CVE-2026-55384

Name of the Vulnerable Software and Affected Versions InvoiceShelf versions prior to 2.4.0

Description InvoiceShelf allows authenticated users to submit manipulated financial totals during the creation of invoices, estimates, and recurring invoices. The application accepts client-supplied values for total, sub total, tax, discount val, and due amount without verifying if they align with the submitted line items. This occurs through the InvoicesRequest::getInvoicePayload function and the corresponding EstimatesRequest and RecurringInvoiceRequest handlers, resulting in stored document totals that disagree with item prices and quantities.

Recommendations Update to version 2.4.0.