Bigprof
Bigprof Online Invoicing System: vulnerabilidades y CVE
Bigprof Online Invoicing System tiene 17 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 1 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE17
Últimos 12 meses0
Críticas1
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2023-6435 | Media (5.4) | 0.39% | — | 30 nov 2023 | A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /inventory/batches_view.php, in the FirstRecord… |
| CVE-2023-6434 | Media (5.4) | 0.39% | — | 30 nov 2023 | A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /inventory/sections_view.php, in the FirstRecord… |
| CVE-2023-6433 | Media (5.4) | 0.39% | — | 30 nov 2023 | A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /inventory/suppliers_view.php, in the FirstRecord… |
| CVE-2023-6432 | Media (5.4) | 0.39% | — | 30 nov 2023 | A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /inventory/items_view.php, in the FirstRecord… |
| CVE-2023-6431 | Media (5.4) | 0.39% | — | 30 nov 2023 | A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /inventory/categories_view.php, in the… |
| CVE-2023-6430 | Media (5.4) | 0.39% | — | 30 nov 2023 | A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /inventory/transactions_view.php, in the… |
| CVE-2023-6429 | Media (5.4) | 0.39% | — | 30 nov 2023 | A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /invoicing/app/clients_view.php, in the… |
| CVE-2023-6428 | Media (5.4) | 0.39% | — | 30 nov 2023 | A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /invoicing/app/items_view.php, in the FirstRecord… |
| CVE-2023-6427 | Media (5.4) | 0.39% | — | 30 nov 2023 | A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /invoicing/app/invoices_view.php, in the… |
| CVE-2023-6426 | Media (5.4) | 0.39% | — | 30 nov 2023 | A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /invoicing/app/invoices_view.php, in the… |
| CVE-2020-35675 | Alta (8.8) | 0.46% | — | 29 sept 2022 | BigProf Online Invoicing System before 3.0 offers a functionality that allows an administrator to move the records of members across groups. The applicable endpoint (admin/pageTransferOwnership.php) lacks CSRF… |
| CVE-2020-35674 | Crítica (9.8) | 1.1% | — | 29 sept 2022 | BigProf Online Invoicing System before 2.9 suffers from an unauthenticated SQL Injection found in /membership_passwordReset.php (the endpoint that is responsible for issuing self-service password resets). An… |
| CVE-2021-27839 | Media (4.4) | 0.72% | — | 3 mar 2021 | A CSV injection vulnerability found in Online Invoicing System (OIS) 4.3 and below can be exploited by users to perform malicious actions such as redirecting admins to unknown or harmful websites, or disclosing other… |
| CVE-2021-21260 | Media (5.4) | 0.60% | — | 22 ene 2021 | Online Invoicing System (OIS) is open source software which is a lean invoicing system for small businesses, consultants and freelancers created using AppGini. In OIS version 4.0 there is a stored XSS which can enables… |
| CVE-2020-35677 | Media (4.8) | 0.33% | — | 24 dic 2020 | BigProf Online Invoicing System before 4.0 fails to adequately sanitize fields for HTML characters upon an administrator using admin/pageEditGroup.php to create a new group, resulting in Stored XSS. The caveat here is… |
| CVE-2020-35676 | Media (6.1) | 0.76% | — | 24 dic 2020 | BigProf Online Invoicing System before 3.1 fails to correctly sanitize an XSS payload when a user registers using the self-registration functionality. As such, an attacker can input a crafted payload that will execute… |
| CVE-2020-6583 | Media (6.1) | 0.69% | — | 8 ene 2020 | BigProf Online Invoicing System (OIS) through 2.6 has XSS that can be leveraged for session hijacking. An attacker can exploit the XSS vulnerability, retrieve the session cookie from the administrator login, and take… |