NCH Software Express Invoice Cross-Site Scripting Vulnerability

NCH Software Express Invoice is an inventory system from NCH Software Australia. The system is mainly used for invoice management, etc. A cross-site scripting vulnerability exists in NCH Software Express Invoice version 7.12, which stems from the lack of proper validation of client-side data in t...

CVE-2019-16282

In NCH Express Invoice v7.12, persistent cross site scripting XSS exists via the Invoices/Items/Customers/Quotes input field. An authenticated unprivileged user can add/modify the Invoices/Items/Customers fields parameter to inject arbitrary JavaScript...

CVE-2019-16282

In NCH Express Invoice v7.12, persistent cross site scripting XSS exists via the Invoices/Items/Customers/Quotes input field. An authenticated unprivileged user can add/modify the Invoices/Items/Customers fields parameter to inject arbitrary JavaScript...

Cross site scripting

In NCH Express Invoice v7.12, persistent cross site scripting XSS exists via the Invoices/Items/Customers/Quotes input field. An authenticated unprivileged user can add/modify the Invoices/Items/Customers fields parameter to inject arbitrary JavaScript...

CVE-2019-16282

In NCH Express Invoice v7.12, persistent cross site scripting XSS exists via the Invoices/Items/Customers/Quotes input field. An authenticated unprivileged user can add/modify the Invoices/Items/Customers fields parameter to inject arbitrary JavaScript...

CVE-2019-16282

CVE-2019-16282 affects NCH Express Invoice v7.12. The vulnerability is a persistent cross-site scripting (XSS) flaw exploitable via the Invoices/Items/Customers/Quotes input fields. An authenticated unprivileged user can modify parameters in these fields to inject arbitrary JavaScript. The issue ...

Remote Code Execution (RCE)

Overview mongo-express is a web-based MongoDB admin interface written with Node.js, Express and Bootstrap3 Affected versions of this package are vulnerable to Remote Code Execution RCE via endpoints that use the toBSON method. A misuse of the vm dependency to perform exec commands in a non-safe...

bem-register (>=1.0.0, <=1.0.5), itstep_server (0.0.1) +4 more potentially affected by CVE-2019-10758 via mongo-express (>=0.19.0, <=0.53.0)

mongo-express NPM version =0.19.0, =1.0.0, =0.1.1, =1.0.0, =1.5.0, =1.6.1 Source cves: CVE-2019-10758 Source advisory: SNYK:JS-MONGOEXPRESS-473215...

PT-2019-14611

Name of the Vulnerable Software and Affected Versions NCH Express Invoice version 7.12 Description The issue concerns a persistent cross-site scripting XSS flaw. This flaw can be exploited via the input fields for Invoices, Items, Customers, and Quotes. An authenticated, unprivileged user can...

CVE-2019-16282: Improper Neutralization of Input During Web Page Generation

In NCH Express Invoice v7.12, persistent cross site scripting XSS exists via the Invoices/Items/Customers/Quotes input field. An authenticated unprivileged user can add/modify the Invoices/Items/Customers fields parameter to inject arbitrary JavaScript...

Express Invoice 7.12 - (Customer) Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Express Invoice 7.12 - 'Customer' Persistent Cross-Site Scripting Exploit Author: Debashis Pal Vendor Homepage: https://www.nchsoftware.com/ Source: https://www.nchsoftware.com/invoice/index.html Version: Express Invoice v7.12 C...

Express Invoice 7.12 - Customer Persistent Cross-Site Scripting

Express Invoice 7.12 - Customer Persistent Cross-Site Scripting Exploit Title: Express Invoice 7.12 - 'Customer' Persistent Cross-Site Scripting Exploit Author: Debashis Pal Date: 2019-10-13 Vendor Homepage: https://www.nchsoftware.com/ Source: https://www.nchsoftware.com/invoice/index.html...

Express Invoice 7.12 - 'Customer' Persistent Cross-Site Scripting

Exploit Title: Express Invoice 7.12 - 'Customer' Persistent Cross-Site Scripting Exploit Author: Debashis Pal Date: 2019-10-13 Vendor Homepage: https://www.nchsoftware.com/ Source: https://www.nchsoftware.com/invoice/index.html Version: Express Invoice v7.12 CVE : N/A Tested on: Windows 7 SP132bi...

Express Invoice 7.12 Cross Site Scripting

Exploit Title: Express Invoice 7.12 - 'Customer' Persistent Cross-Site Scripting Exploit Author: Debashis Pal Date: 2019-10-13 Vendor Homepage: https://www.nchsoftware.com/ Source: https://www.nchsoftware.com/invoice/index.html Version: Express Invoice v7.12 CVE : N/A Tested on: Windows 7 SP132bi...

PT-2019-4513

Name of the Vulnerable Software and Affected Versions mongo-express versions prior to 0.54.0 Description The issue is related to incorrect code generation management in the Mongo-express web interface for MongoDB database management. It allows a remote attacker to execute arbitrary code in the...

Cisco Unified Intelligence Center (CUIC) Software Cross-Site Scripting Vulnerability

Cross-site scripting XSS vulnerability in Cisco Unified Intelligence Center CUIC 8.5.4 through 9.11, as used in Unified Contact Center Express 10.01 through 11.01, allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug IDs CSCuy75020 and CSCuy81652. C Tenable...

Phoenix Contact Automation Worx CVE-2019-16675 Remote Code Execution Vulnerability

Description Phoenix Contact Automation Worx is prone to a remote code-execution vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely cause a denial-of-service condition. The...

Sql injection

The nex-forms-express-wp-form-builder plugin before 4.6.1 for WordPress has SQL injection via the wp-admin/admin.php?page=nex-forms-main nexformsId parameter...

CVE-2015-9452

The nex-forms-express-wp-form-builder plugin before 4.6.1 for WordPress has SQL injection via the wp-admin/admin.php?page=nex-forms-main nexformsId parameter...

PT-2019-7411 · Nexforms · Nex-Forms-Express-Wp-Form-Builder

Name of the Vulnerable Software and Affected Versions: nex-forms-express-wp-form-builder plugin versions prior to 4.6.1 Description: The issue is related to SQL injection via the "wp-admin/admin.php?page=nex-forms-main" API endpoint, specifically through the nex forms Id parameter. This allows fo...