CVE-2023-45892

An issue discovered in the Order and Invoice pages in Floorsight Insights Q3 2023 allows an unauthenticated remote attacker to view sensitive customer information...

CVE-2023-45893: Authorization Bypass Through User-Controlled Key

An indirect Object Reference IDOR in the Order and Invoice pages in Floorsight Customer Portal Q3 2023 allows an unauthenticated remote attacker to view sensitive customer information...

CVE-2023-45892

Technical details are not publicly available in the provided documents. The Connected records reiterate the issue description without specifics on affected versions, root cause, or fixes. Monitor for updates from vendors and security databases.

WordPress WooCommerce PDF Invoice Builder Plugin <= 1.2.101 is vulnerable to Cross Site Request Forgery (CSRF)

Software WooCommerce PDF Invoice Builder Type Plugin Vulnerable versions = 1.2.101 Fixed in 1.2.102 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-51486 Patch priority Low CVSS severity Low 5.4 Developer Edgar Rojas PSID 0520b4dedf5c Credits...

Open redirect

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in CRM Perks Integration for WooCommerce and Zoho CRM, Books, Invoice, Inventory, Bigin.This issue affects Integration for WooCommerce and Zoho CRM, Books, Invoice, Inventory, Bigin: from n/a before 1.3.7...

CVE-2023-38481

CVE-2023-38481 is an Open Redirect vulnerability in the CRM Perks Integration for WooCommerce and Zoho CRM, Books, Invoice, Inventory, Bigin. Affected versions are before 1.3.7 (vendor/n/a). The issue allows redirection to an untrusted site, enabling a user-safe impact such as phishing-like redir...

PT-2023-29751 · Floorsight · Floorsight Customer Portal Q3 2023

Name of the Vulnerable Software and Affected Versions: Floorsight Customer Portal Q3 2023 Description: An indirect Object Reference IDOR in the Order and Invoice pages allows an unauthenticated remote attacker to view sensitive customer information. Recommendations: As a temporary workaround,...

CVE-2023-6650

A vulnerability was found in SourceCodester Simple Invoice Generator System 1.0 and classified as problematic. This issue affects some unknown processing of the file login.php. The manipulation of the argument cashier leads to cross site scripting. The attack may be initiated remotely. The exploi...

CVE-2023-6650

A vulnerability was found in SourceCodester Simple Invoice Generator System 1.0 and classified as problematic. This issue affects some unknown processing of the file login.php. The manipulation of the argument cashier leads to cross site scripting. The attack may be initiated remotely. The exploi...

Cross site scripting

A vulnerability was found in SourceCodester Simple Invoice Generator System 1.0 and classified as problematic. This issue affects some unknown processing of the file login.php. The manipulation of the argument cashier leads to cross site scripting. The attack may be initiated remotely. The exploi...

CVE-2023-6650

CVE-2023-6650 affects SourceCodester Simple Invoice Generator System 1.0. The vulnerability is a cross-site scripting flaw in the login.php handling of the cashier parameter. The issue allows an attacker to inject scripts that may be executed in the context of the victim’s browser. Remote initiat...

CVE-2023-6650 SourceCodester Simple Invoice Generator System login.php cross site scripting

A vulnerability was found in SourceCodester Simple Invoice Generator System 1.0 and classified as problematic. This issue affects some unknown processing of the file login.php. The manipulation of the argument cashier leads to cross site scripting. The attack may be initiated remotely. The exploi...

CVE-2023-6650 SourceCodester Simple Invoice Generator System login.php cross site scripting

A vulnerability was found in SourceCodester Simple Invoice Generator System 1.0 and classified as problematic. This issue affects some unknown processing of the file login.php. The manipulation of the argument cashier leads to cross site scripting. The attack may be initiated remotely. The exploi...

CVE-2023-6650: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in SourceCodester Simple Invoice Generator System 1.0 and classified as problematic. This issue affects some unknown processing of the file login.php. The manipulation of the argument cashier leads to cross site scripting. The attack may be initiated remotely. The exploi...

SourceCodester Simple Invoice Generator System Cross-Site Scripting Vulnerability

Simple Invoice Generator System is a simple invoice generator system by Carlo Montero Personal Developer. A cross-site scripting vulnerability exists in SourceCodester Simple Invoice Generator System version 1.0, which stems from a cross-site scripting XSS vulnerability in the file login.php...

Mars: Critical Unauthenticated Access to Sensitive Employee and Customer Data Including Invoice Details at ████

During a reconnaissance phase, a directory named 'SSO' was discovered on the website ████████. Upon accessing this directory, it redirected to ██████████, where sensitive employee and customer data, including usernames, emails, purchase history, payment history, bills, phone numbers, customer...

The vulnerability of the Invoice Edit Page of the Bitrix24 business management service allows a attacker to perform XSS attacks.

The vulnerability of the Invoice Edit Page of the Bitrix24 business management service relates to the failure to take measures to neutralize the script in the web page’s attributes. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

CVE-2023-1716

Cross-site scripting XSS vulnerability in Invoice Edit Page in Bitrix24 22.0.300 allows attackers to execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege...

CVE-2023-1716 Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (2 of 2)

Cross-site scripting XSS vulnerability in Invoice Edit Page in Bitrix24 22.0.300 allows attackers to execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege...

CVE-2023-1715 Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (1 of 2)

A logic error when using mbstrpos to check for potential XSS payload in Bitrix24 22.0.300 allows attackers to bypass XSS sanitisation via placing HTML tags at the begining of the payload...