Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
bigprof online invoicing system vulnerabilities and exploits
(subscribe to this query)
9.8
CVSSv3
CVE-2020-35674
BigProf Online Invoicing System prior to 2.9 suffers from an unauthenticated SQL Injection found in /membership_passwordReset.php (the endpoint that is responsible for issuing self-service password resets). An unauthenticated attacker is able to send a request containing a crafte...
Bigprof Online Invoicing System
8.8
CVSSv3
CVE-2020-35675
BigProf Online Invoicing System prior to 3.0 offers a functionality that allows an administrator to move the records of members across groups. The applicable endpoint (admin/pageTransferOwnership.php) lacks CSRF protection, resulting in an attacker being able to escalate their pr...
Bigprof Online Invoicing System
4.8
CVSSv3
CVE-2020-35677
BigProf Online Invoicing System prior to 4.0 fails to adequately sanitize fields for HTML characters upon an administrator using admin/pageEditGroup.php to create a new group, resulting in Stored XSS. The caveat here is that an attacker would need administrative privileges in ord...
Bigprof Online Invoicing System
6.1
CVSSv3
CVE-2020-35676
BigProf Online Invoicing System prior to 3.1 fails to correctly sanitize an XSS payload when a user registers using the self-registration functionality. As such, an attacker can input a crafted payload that will execute upon the application's administrator browsing the regis...
Bigprof Online Invoicing System
4.4
CVSSv3
CVE-2021-27839
A CSV injection vulnerability found in Online Invoicing System (OIS) 4.3 and below can be exploited by users to perform malicious actions such as redirecting admins to unknown or harmful websites, or disclosing other clients' details that the user did not have access to.
Bigprof Online Invoicing System
6.1
CVSSv3
CVE-2020-6583
BigProf Online Invoicing System (OIS) up to and including 2.6 has XSS that can be leveraged for session hijacking. An attacker can exploit the XSS vulnerability, retrieve the session cookie from the administrator login, and take over the administrator account via the Name field i...
Bigprof Online Invoicing System
5.4
CVSSv3
CVE-2023-6426
A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /invoicing/app/invoices_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow...
Bigprof Online Invoicing System 2.6
5.4
CVSSv3
CVE-2023-6427
A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /invoicing/app/invoices_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow...
Bigprof Online Invoicing System 2.6
5.4
CVSSv3
CVE-2023-6428
A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /invoicing/app/items_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an...
Bigprof Online Invoicing System 2.6
5.4
CVSSv3
CVE-2023-6429
A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /invoicing/app/clients_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow ...
Bigprof Online Invoicing System 2.6
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
NULL pointer dereference
CVE-2023-52689
CVE-2024-23803
client side
CVE-2023-52696
information disclosure
CVE-2024-35843
CVE-2024-27130
CVE-2023-52697
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
NEXT »