1892 matches found
Open redirect
URL Redirection to Untrusted Site 'Open Redirect' vulnerability in CRM Perks Integration for WooCommerce and Zoho CRM, Books, Invoice, Inventory, Bigin.This issue affects Integration for WooCommerce and Zoho CRM, Books, Invoice, Inventory, Bigin: from n/a before 1.3.7...
CVE-2023-38481
CVE-2023-38481 is an Open Redirect vulnerability in the CRM Perks Integration for WooCommerce and Zoho CRM, Books, Invoice, Inventory, Bigin. Affected versions are before 1.3.7 (vendor/n/a). The issue allows redirection to an untrusted site, enabling a user-safe impact such as phishing-like redir...
PT-2023-29751 · Floorsight · Floorsight Customer Portal Q3 2023
Name of the Vulnerable Software and Affected Versions: Floorsight Customer Portal Q3 2023 Description: An indirect Object Reference IDOR in the Order and Invoice pages allows an unauthenticated remote attacker to view sensitive customer information. Recommendations: As a temporary workaround,...
CVE-2023-6650
A vulnerability was found in SourceCodester Simple Invoice Generator System 1.0 and classified as problematic. This issue affects some unknown processing of the file login.php. The manipulation of the argument cashier leads to cross site scripting. The attack may be initiated remotely. The exploi...
CVE-2023-6650
A vulnerability was found in SourceCodester Simple Invoice Generator System 1.0 and classified as problematic. This issue affects some unknown processing of the file login.php. The manipulation of the argument cashier leads to cross site scripting. The attack may be initiated remotely. The exploi...
Cross site scripting
A vulnerability was found in SourceCodester Simple Invoice Generator System 1.0 and classified as problematic. This issue affects some unknown processing of the file login.php. The manipulation of the argument cashier leads to cross site scripting. The attack may be initiated remotely. The exploi...
CVE-2023-6650
CVE-2023-6650 affects SourceCodester Simple Invoice Generator System 1.0. The vulnerability is a cross-site scripting flaw in the login.php handling of the cashier parameter. The issue allows an attacker to inject scripts that may be executed in the context of the victim’s browser. Remote initiat...
CVE-2023-6650 SourceCodester Simple Invoice Generator System login.php cross site scripting
A vulnerability was found in SourceCodester Simple Invoice Generator System 1.0 and classified as problematic. This issue affects some unknown processing of the file login.php. The manipulation of the argument cashier leads to cross site scripting. The attack may be initiated remotely. The exploi...
CVE-2023-6650 SourceCodester Simple Invoice Generator System login.php cross site scripting
A vulnerability was found in SourceCodester Simple Invoice Generator System 1.0 and classified as problematic. This issue affects some unknown processing of the file login.php. The manipulation of the argument cashier leads to cross site scripting. The attack may be initiated remotely. The exploi...
SourceCodester Simple Invoice Generator System Cross-Site Scripting Vulnerability
Simple Invoice Generator System is a simple invoice generator system by Carlo Montero Personal Developer. A cross-site scripting vulnerability exists in SourceCodester Simple Invoice Generator System version 1.0, which stems from a cross-site scripting XSS vulnerability in the file login.php...
Mars: Critical Unauthenticated Access to Sensitive Employee and Customer Data Including Invoice Details at ████
During a reconnaissance phase, a directory named 'SSO' was discovered on the website ████████. Upon accessing this directory, it redirected to ██████████, where sensitive employee and customer data, including usernames, emails, purchase history, payment history, bills, phone numbers, customer...
The vulnerability of the Invoice Edit Page of the Bitrix24 business management service allows a attacker to perform XSS attacks.
The vulnerability of the Invoice Edit Page of the Bitrix24 business management service relates to the failure to take measures to neutralize the script in the web page’s attributes. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...
CVE-2023-1716
Cross-site scripting XSS vulnerability in Invoice Edit Page in Bitrix24 22.0.300 allows attackers to execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege...
CVE-2023-1716 Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (2 of 2)
Cross-site scripting XSS vulnerability in Invoice Edit Page in Bitrix24 22.0.300 allows attackers to execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege...
CVE-2023-1715 Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (1 of 2)
A logic error when using mbstrpos to check for potential XSS payload in Bitrix24 22.0.300 allows attackers to bypass XSS sanitisation via placing HTML tags at the begining of the payload...
PT-2023-6692 · Bitrix +1 · Bitrix24 +1
Name of the Vulnerable Software and Affected Versions: Bitrix24 version 22.0.300 Description: A cross-site scripting XSS issue in the Invoice Edit Page of Bitrix24 allows attackers to execute arbitrary JavaScript code in the victim's browser. If the victim has administrator privileges, it is also...
Bitrix24 Cross-Site Scripting Vulnerability
Bitrix24 is a suite of enterprise social platforms from Bitrix USA. The platform includes features such as online communication, calendar management, and CRM Customer Relationship Management. A security vulnerability exists in Bitrix24 version 22.0.300, which stems from a cross-site scripting XSS...
Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File
Description The laters version of Kimai is found to be vulnerable to a critical Server-Side Template Injection SSTI which can be escalated to Remote Code Execution RCE. The vulnerability arises when a malicious user uploads a specially crafted Twig file, exploiting the software's PDF and HTML...
PT-2023-29925 · Kimai · Kimai
Name of the Vulnerable Software and Affected Versions: Kimai versions prior to 2.1.0 Description: Kimai, a web-based multi-user time-tracking application, is vulnerable to a Server-Side Template Injection SSTI which can be escalated to Remote Code Execution RCE. The vulnerability arises when a...