Basic Inventory Stock Management And Invoicing 2.0 Insecure Direct Object Reference

==================================================================================================================================== | Title : Basic Inventory - Stock Management and Invoicing v2.0 Missing Authorization Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro...

CVE-2020-35675

BigProf Online Invoicing System before 3.0 offers a functionality that allows an administrator to move the records of members across groups. The applicable endpoint admin/pageTransferOwnership.php lacks CSRF protection, resulting in an attacker being able to escalate their privileges to...

CVE-2020-35674

BigProf Online Invoicing System before 2.9 suffers from an unauthenticated SQL Injection found in /membershippasswordReset.php the endpoint that is responsible for issuing self-service password resets. An unauthenticated attacker is able to send a request containing a crafted payload that can...

CVE-2020-35675

BigProf Online Invoicing System before 3.0 offers a functionality that allows an administrator to move the records of members across groups. The applicable endpoint admin/pageTransferOwnership.php lacks CSRF protection, resulting in an attacker being able to escalate their privileges to...

CVE-2020-35674

BigProf Online Invoicing System before 2.9 suffers from an unauthenticated SQL Injection found in /membershippasswordReset.php the endpoint that is responsible for issuing self-service password resets. An unauthenticated attacker is able to send a request containing a crafted payload that can...

Cross site request forgery (csrf)

BigProf Online Invoicing System before 3.0 offers a functionality that allows an administrator to move the records of members across groups. The applicable endpoint admin/pageTransferOwnership.php lacks CSRF protection, resulting in an attacker being able to escalate their privileges to...

Sql injection

BigProf Online Invoicing System before 2.9 suffers from an unauthenticated SQL Injection found in /membershippasswordReset.php the endpoint that is responsible for issuing self-service password resets. An unauthenticated attacker is able to send a request containing a crafted payload that can...

BigProf Online Invoicing System SQL注入漏洞

BigProf Online Invoicing System OIS is an online invoicing system. A security vulnerability exists in the BigProf Online Invoicing System prior to version 2.9, which stems from the presence of an unauthenticated SQL injection, where an unauthenticated attacker is able to send a request containing...

Clever Phishing Scam Uses Legitimate PayPal Messages

Brian Krebs is reporting on a clever PayPal phishing scam that uses legitimate PayPal messaging. Basically, the scammers use the PayPal invoicing system to send the email. The email lists a phone number to dispute the charge, which is not PayPal and quickly turns into a request to download and...

invoiceninja cross-site scripting vulnerability

invoiceninja is an open source invoicing application built with Laravel and Flutter. invoiceninja suffers from a cross-site scripting vulnerability that can be exploited by attackers to execute malicious scripts...

CVE-2021-24999

The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcjnotice parameter before outputting it back in the admin dashboard when the Pdf Invoicing module is enabled, leading to a Reflected Cross-Site Scripting...

CVE-2021-24999

The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcjnotice parameter before outputting it back in the admin dashboard when the Pdf Invoicing module is enabled, leading to a Reflected Cross-Site Scripting...

CVE-2021-24999

The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcjnotice parameter before outputting it back in the admin dashboard when the Pdf Invoicing module is enabled, leading to a Reflected Cross-Site Scripting...

Cross site scripting

The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcjnotice parameter before outputting it back in the admin dashboard when the Pdf Invoicing module is enabled, leading to a Reflected Cross-Site Scripting...

CVE-2021-24999 Booster for Woocommerce < 5.4.9 - Reflected Cross-Site Scripting in PDF Invoicing Module

The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcjnotice parameter before outputting it back in the admin dashboard when the Pdf Invoicing module is enabled, leading to a Reflected Cross-Site Scripting...

PT-2022-9556

Name of the Vulnerable Software and Affected Versions The Booster for WooCommerce WordPress plugin versions prior to 5.4.9 Description The issue arises from the lack of sanitization and escaping of the wcj notice parameter in the admin dashboard when the Pdf Invoicing module is enabled, leading t...

CVE-2021-24999: Improper Neutralization of Input During Web Page Generation

The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcjnotice parameter before outputting it back in the admin dashboard when the Pdf Invoicing module is enabled, leading to a Reflected Cross-Site Scripting...

Amios Emuse-eServices/eNvoice has an unspecified vulnerability

Amios Emuse-eServices/eNvoice is an electronic invoicing service from the Israeli company Amios. It is a digital interface that simplifies the collection process and automatically sends invoices to customers via email. Amios Emuse-eServices/eNvoice suffers from a security vulnerability that stems...

Amios Emuse-eServices/eNvoice SQL Injection Vulnerability

Amios Emuse-eServices/eNvoice is an electronic invoicing service from the Israeli company Amios. It is a digital interface that simplifies the collection process and automatically sends invoices to customers via email.Amios Emuse-eServices/eNvoice suffers from a SQL injection vulnerability, which...

Booster for Woocommerce < 5.4.9 - Reflected Cross-Site Scripting in PDF Invoicing Module

The plugin does not sanitise and escape the wcjnotice parameter before outputting it back in the admin dashboard when the Pdf Invoicing module is enabled, leading to a Reflected Cross-Site Scripting With the PDF Invoicing module active:...