CVE-2020-35677

BigProf Online Invoicing System before 4.0 fails to adequately sanitize fields for HTML characters upon an administrator using admin/pageEditGroup.php to create a new group, resulting in Stored XSS. The caveat here is that an attacker would need administrative privileges in order to create the...

PT-2020-17387

Name of the Vulnerable Software and Affected Versions BigProf Online Invoicing System versions prior to 4.0 Description The issue arises from inadequate sanitization of fields for HTML characters when an administrator creates a new group using the "admin/pageEditGroup.php" endpoint, resulting in...

CVE-2020-35677: Improper Neutralization of Input During Web Page Generation

BigProf Online Invoicing System before 4.0 fails to adequately sanitize fields for HTML characters upon an administrator using admin/pageEditGroup.php to create a new group, resulting in Stored XSS. The caveat here is that an attacker would need administrative privileges in order to create the...