CVE-2015-4382: Multiple cross-site request forgery (CSRF) vulnerabilities in the Invoice module 6.x-1.x before 6.x-1.2 and...

Security readout for executives and security teams

This issue affects Drupal sites using vulnerable versions of the Invoice contributed module. A malicious site could cause a logged-in user’s browser to create, delete, or alter invoices without the user intending it. Business impact depends on whether the module is used for real billing or records. Exposure is limited to Drupal installations with the Invoice module installed on affected 6.x-1.x or 7.x-1.x versions. Sites not using this module are not indicated as affected by the provided sources. Treat as a targeted business-integrity risk, not an internet-wide emergency. Prioritize if the affected module supports billing, customer records, or finance workflows. Mitigation focus: Upgrade Invoice 6.x-1.x to 6.x-1.2 or later.; Upgrade Invoice 7.x-1.x to 7.x-1.3 or later.; Check Drupal advisory guidance before making production changes..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.