CVE-2023-42253

Code-Projects Vehicle Management 1.0 is vulnerable to Cross Site Scripting XSS in Add Accounts via Invoice No, To, and Mammul...

CVE-2023-42253

Code-Projects Vehicle Management 1.0 is vulnerable to Cross Site Scripting XSS in Add Accounts via Invoice No, To, and Mammul...

CVE-2023-42253

Code-Projects Vehicle Management 1.0 is vulnerable to Cross Site Scripting XSS in Add Accounts via Invoice No, To, and Mammul...

Cross site scripting

Code-Projects Vehicle Management 1.0 is vulnerable to Cross Site Scripting XSS in Add Accounts via Invoice No, To, and Mammul...

SourceCodester Vehicle Management Cross-Site Scripting Vulnerability

SourceCodester Vehicle Management is a vehicle management software from SourceCodester, Inc. A security vulnerability exists in SourceCodester Vehicle Management version 1.0 that stems from the susceptibility to cross-site scripting XSS attacks when adding accounts via invoice numbers, recipients...

CVE-2023-42253

Code-Projects Vehicle Management 1.0 is vulnerable to Cross Site Scripting XSS in Add Accounts via Invoice No, To, and Mammul...

CVE-2023-42253

Code-Projects Vehicle Management 1.0 is vulnerable to Cross Site Scripting (XSS) in the Add Accounts workflow via Invoice No, To, and Mammul. The vulnerability is documented under CVE-2023-42253 across multiple sources, with general indication of XSS risk but without concrete exploitation details...

CVE-2023-42253

Code-Projects Vehicle Management 1.0 is vulnerable to Cross Site Scripting XSS in Add Accounts via Invoice No, To, and Mammul...

PT-2023-28300

Name of the Vulnerable Software and Affected Versions Code-Projects Vehicle Management version 1.0 Description The issue concerns Cross Site Scripting XSS in the Add Accounts feature, specifically via the Invoice No, To, and Mammul fields. This allows for potential malicious script injection...

CVE-2023-42253: Improper Neutralization of Input During Web Page Generation

Code-Projects Vehicle Management 1.0 is vulnerable to Cross Site Scripting XSS in Add Accounts via Invoice No, To, and Mammul...

WooCommerce PDF Invoice Builder < 1.2.90 - Subscriber+ SQLi

Description The plugin does not properly sanitise and escape the pageId parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscribers...

WooCommerce PDF Invoice Builder < 1.2.91 - Invoice Update via CSRF

Description The plugin does not have CSRF check when updating invoices, which could allow attackers to make logged in admin perform such action via a CSRF attack...

WooCommerce PDF Invoice Builder < 1.2.91 - Invoice Fields Creation via CSRF

Description The plugin does not have CSRF check when creating invoice fields, which could allow attackers to make logged in admin perform such action via a CSRF attack...

WooCommerce PDF Invoice Builder < 1.2.92 - Subscriber+ Arbitrary Invoice Access

Description The plugin does not have authorisation in the GetInvoiceDetail function, allowing any authenticated users, such as subscriber to access arbitrary invoice by knowing or guessing the order and invoice IDs...

WooCommerce PDF Invoice Builder < 1.2.91 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-4161

The WooCommerce PDF Invoice Builder for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the SaveCustomField function in versions up to, and including, 1.2.90. This makes it possible for unauthenticated attackers to create invoice fields provided they can tric...

CVE-2023-3677

The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to SQL Injection via the pageId parameter in versions up to, and including, 1.2.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possibl...

CVE-2023-3764

The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.90. This is due to missing or incorrect nonce validation on the Save function. This makes it possible for unauthenticated attackers to make changes to invoice...

CVE-2023-4160

The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.2.90 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-leve...

CVE-2023-4245

The WooCommerce PDF Invoice Builder for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the GetInvoiceDetail function in versions up to, and including, 1.2.89. This makes it possible for subscribers to view arbitrary invoices provided they can guess the...