1864 matches found
CVE-2023-6650 SourceCodester Simple Invoice Generator System login.php cross site scripting
A vulnerability was found in SourceCodester Simple Invoice Generator System 1.0 and classified as problematic. This issue affects some unknown processing of the file login.php. The manipulation of the argument cashier leads to cross site scripting. The attack may be initiated remotely. The exploi...
SourceCodester Simple Invoice Generator System Cross-Site Scripting Vulnerability
Simple Invoice Generator System is a simple invoice generator system by Carlo Montero Personal Developer. A cross-site scripting vulnerability exists in SourceCodester Simple Invoice Generator System version 1.0, which stems from a cross-site scripting XSS vulnerability in the file login.php...
Mars: Critical Unauthenticated Access to Sensitive Employee and Customer Data Including Invoice Details at ████
During a reconnaissance phase, a directory named 'SSO' was discovered on the website ████████. Upon accessing this directory, it redirected to ██████████, where sensitive employee and customer data, including usernames, emails, purchase history, payment history, bills, phone numbers, customer...
The vulnerability of the Invoice Edit Page of the Bitrix24 business management service allows a attacker to perform XSS attacks.
The vulnerability of the Invoice Edit Page of the Bitrix24 business management service relates to the failure to take measures to neutralize the script in the web page’s attributes. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...
CVE-2023-1716
Cross-site scripting XSS vulnerability in Invoice Edit Page in Bitrix24 22.0.300 allows attackers to execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege...
CVE-2023-1716 Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (2 of 2)
Cross-site scripting XSS vulnerability in Invoice Edit Page in Bitrix24 22.0.300 allows attackers to execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege...
CVE-2023-1715 Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (1 of 2)
A logic error when using mbstrpos to check for potential XSS payload in Bitrix24 22.0.300 allows attackers to bypass XSS sanitisation via placing HTML tags at the begining of the payload...
PT-2023-6692 · Bitrix +1 · Bitrix24 +1
Name of the Vulnerable Software and Affected Versions: Bitrix24 version 22.0.300 Description: A cross-site scripting XSS issue in the Invoice Edit Page of Bitrix24 allows attackers to execute arbitrary JavaScript code in the victim's browser. If the victim has administrator privileges, it is also...
Bitrix24 Cross-Site Scripting Vulnerability
Bitrix24 is a suite of enterprise social platforms from Bitrix USA. The platform includes features such as online communication, calendar management, and CRM Customer Relationship Management. A security vulnerability exists in Bitrix24 version 22.0.300, which stems from a cross-site scripting XSS...
Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File
Description The laters version of Kimai is found to be vulnerable to a critical Server-Side Template Injection SSTI which can be escalated to Remote Code Execution RCE. The vulnerability arises when a malicious user uploads a specially crafted Twig file, exploiting the software's PDF and HTML...
PT-2023-29925 · Kimai · Kimai
Name of the Vulnerable Software and Affected Versions: Kimai versions prior to 2.1.0 Description: Kimai, a web-based multi-user time-tracking application, is vulnerable to a Server-Side Template Injection SSTI which can be escalated to Remote Code Execution RCE. The vulnerability arises when a...
CVE-2023-5443
Improper Protection for Outbound Error Messages and Alert Signals vulnerability in EDM Informatics E-invoice allows Account Footprinting. This issue affects E-invoice: before 2.1...
CVE-2023-5443
Improper Protection for Outbound Error Messages and Alert Signals vulnerability in EDM Informatics E-invoice allows Account Footprinting.This issue affects E-invoice: before 2.1...
CVE-2023-5443
Improper Protection for Outbound Error Messages and Alert Signals vulnerability in EDM Informatics E-invoice allows Account Footprinting. This issue affects E-invoice: before 2.1...
CVE-2023-5443 User Enumeration in EDM Informatic's E-Invoice Software
Improper Protection for Outbound Error Messages and Alert Signals vulnerability in EDM Informatics E-invoice allows Account Footprinting. This issue affects E-invoice: before 2.1...
CVE-2023-5443
EDM Informatics E-invoice (version prior to 2.1) is affected by CVE-2023-5443 due to improper protection for outbound error messages and alert signals, enabling account footprinting. The issue originates from the handling of error messages that may disclose sensitive account information. Affected...
CVE-2023-5443 User Enumeration in EDM Informatic's E-Invoice Software
Improper Protection for Outbound Error Messages and Alert Signals vulnerability in EDM Informatics E-invoice allows Account Footprinting. This issue affects E-invoice: before 2.1...
WooCommerce PDF Invoice Builder < 1.2.104 - Reflected XSS
Description The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
Infodrom Software E-Invoice Approval System Security Breach
Infodrom Software E-Invoice Approval System is an electronic invoice approval system from Infodrom Software, Turkey. A security vulnerability exists in Infodrom Software E-Invoice Approval System version 2.1 that stems from improper protection of outbound error messages and alert signals...