InvoicePlane version 1.4.10 suffers from cross site scripting and remote file upload vulnerabilities.