Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
bigprof online invoicing system vulnerabilities and exploits
(subscribe to this query)
9.8
CVSSv3
CVE-2020-35674
BigProf Online Invoicing System prior to 2.9 suffers from an unauthenticated SQL Injection found in /membership_passwordReset.php (the endpoint that is responsible for issuing self-service password resets). An unauthenticated attacker is able to send a request containing a crafte...
Bigprof Online Invoicing System
8.8
CVSSv3
CVE-2020-35675
BigProf Online Invoicing System prior to 3.0 offers a functionality that allows an administrator to move the records of members across groups. The applicable endpoint (admin/pageTransferOwnership.php) lacks CSRF protection, resulting in an attacker being able to escalate their pr...
Bigprof Online Invoicing System
6.1
CVSSv3
CVE-2020-35676
BigProf Online Invoicing System prior to 3.1 fails to correctly sanitize an XSS payload when a user registers using the self-registration functionality. As such, an attacker can input a crafted payload that will execute upon the application's administrator browsing the regis...
Bigprof Online Invoicing System
6.1
CVSSv3
CVE-2020-6583
BigProf Online Invoicing System (OIS) up to and including 2.6 has XSS that can be leveraged for session hijacking. An attacker can exploit the XSS vulnerability, retrieve the session cookie from the administrator login, and take over the administrator account via the Name field i...
Bigprof Online Invoicing System
5.4
CVSSv3
CVE-2023-6426
A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /invoicing/app/invoices_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow...
Bigprof Online Invoicing System 2.6
5.4
CVSSv3
CVE-2023-6427
A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /invoicing/app/invoices_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow...
Bigprof Online Invoicing System 2.6
5.4
CVSSv3
CVE-2023-6428
A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /invoicing/app/items_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an...
Bigprof Online Invoicing System 2.6
5.4
CVSSv3
CVE-2023-6429
A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /invoicing/app/clients_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow ...
Bigprof Online Invoicing System 2.6
5.4
CVSSv3
CVE-2023-6430
A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /inventory/transactions_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow...
Bigprof Online Invoicing System 2.6
5.4
CVSSv3
CVE-2023-6431
A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /inventory/categories_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow a...
Bigprof Online Invoicing System 2.6
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-22120
CVE-2024-35921
CVE-2024-35874
brute force
CVE-2024-36080
unprivileged
CVE-2024-35917
IDOR
CVE-2024-4947
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
NEXT »