CVE-2022-0514 Business Logic Errors in crater-invoice/crater

Business Logic Errors in GitHub repository crater-invoice/crater prior to 6.0.5...

Crater Invoice Crater 跨站请求伪造漏洞

Crater Invoice Crater is an open source web and mobile application from Crater Invoice, Inc. for tracking expenses, payments and creating professional invoices and estimates. A cross-site request forgery vulnerability existed in Crater Invoice Crater prior to 6.0.4, no information about this...

Sourcecodester Simple Client Management System SQL注入漏洞

Sourcecodester Simple Client Management System is a simple web-based application that provides an online platform to manage company customer invoices. sourcecodester Simple Client Management System is vulnerable to SQL injection vulnerability, which stems from the application's lack of validation...

Cross-site Scripting in Crater Invoice

Crater invoice prior to version 6.0.0 has a cross-site scripting vulnerability...

GHSA-6VFW-74WR-3CHH Cross-site Scripting in Crater Invoice

Crater invoice prior to version 6.0.0 has a cross-site scripting vulnerability...

CVE-2022-0372 Cross-site Scripting (XSS) - Stored in crater-invoice/crater

Cross-site Scripting XSS - Stored in Packagist bytefury/crater prior to 6.0.2...

Cross-Site Request Forgery (CSRF) in crater-invoice/crater

Description An attacker is able to log out a user if a logged-in user visits the attacker's website. Proof of Concept history.pushState'', '', '/' document.forms0.submit; Impact This vulnerability is capable of forging users to unintentional logout. More details One way GET could be abused here i...

GHSA-XH9G-CP3V-P8Q4 Missing Authorization in Crater Invoice

Crater Invoice prior to version 6.0.2 has a missing authorization vulnerability...

Missing Authorization in Crater Invoice

Crater Invoice prior to version 6.0.2 has a missing authorization vulnerability...

CVE-2022-0203

Improper Access Control in GitHub repository crater-invoice/crater prior to 6.0.2...

Improper access control

Improper Access Control in GitHub repository crater-invoice/crater prior to 6.0.2...

CVE-2022-0203 Improper Access Control in crater-invoice/crater

Improper Access Control in GitHub repository crater-invoice/crater prior to 6.0.2...

Crater Invoice crater 安全漏洞

Crater Invoice Crater is an open source web and mobile application from Crater Invoice, Inc. for tracking expenses, payments and creating professional invoices and estimates. Crater Invoice crater has a security vulnerability that stems from improper access control in the GitHub repository prior ...

CVE-2022-0242

Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0...

CVE-2022-0242

Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0...

CVE-2022-0242 Unrestricted Upload of File with Dangerous Type in crater-invoice/crater

Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0...

Cross-site Scripting (XSS) - Stored in crater-invoice/crater

Description There is a vulnerability in the upload avatar functionality of crater invoice which would allow an attacker to upload malicious .SVG files in order to execute Javascript. All that is required is that the victim browse to the link location of the .SVG file Proof of Concept xss.svg:...

CVE-2021-4080 Unrestricted Upload of File with Dangerous Type in crater-invoice/crater

crater is vulnerable to Unrestricted Upload of File with Dangerous Type...

Crater Invoice Crater 代码问题漏洞

Crater Invoice Crater is an open source web and mobile application from Crater Invoice, Inc. for tracking expenses, payments and creating professional invoices and estimates. Crater Invoice crater suffers from a code issue vulnerability that stems from the unrestricted upload of dangerous types o...

Improper Access Control in crater-invoice/crater

Description In recent Crater version faf1ef09 tag: 5.0.6 I discovered, that not authenticated user can download all expense receipts uploaded to any company. Proof of Concept Python import requests for i in range1, 100: r = requests.getf'http://172.17.0.1:8080/expenses/i/download-receipt' if...