WordPress WP-Invoice 4.3.1 Cross Site Scripting

Exploit Title: WordPress Plugin WP-Invoice - Stored Cross Site Scripting Date: 25-04-2022 Exploit Author: Mariam Tariq - HunterSherlock Vendor Homepage: https://wordpress.org/plugins/WP-Invoice/ Version: 4.3.1 Tested on: Firefox Contact me: [email protected] Vulnerable Code: wpi.businessna...

WordPress WP-Invoice 4.3.1 Cross Site Scripting Vulnerability

Exploit Title: WordPress Plugin WP-Invoice - Stored Cross Site Scripting Exploit Author: Mariam Tariq - HunterSherlock Vendor Homepage: https://wordpress.org/plugins/WP-Invoice/ Version: 4.3.1 Tested on: Firefox Contact me: email protected Vulnerable Code: wpi.businessname = ''; POC 1. Install th...

WP-Invoice <= 4.3.1 - Stored Cross-Site Scripting via CSRF

The plugin does not have CSRF check in place when updating its settings, and is lacking sanitisation as well as escaping in some of them, allowing attacker to make a logged in admin change them and add XSS payload in them PoC...

WP-Invoice <= 4.3.1 - Stored Cross-Site Scripting via CSRF

The plugin does not have CSRF check in place when updating its settings, and is lacking sanitisation as well as escaping in some of them, allowing attacker to make a logged in admin change them and add XSS payload in them ' /...

CVE-2021-43505

Multiple Cross Site Scripting XSS vulnerabilities exist in Ssourcecodester Simple Client Management System v1 via 1 Add new Client and 2 Add new invoice...

CVE-2021-43505

Multiple Cross Site Scripting XSS vulnerabilities exist in Ssourcecodester Simple Client Management System v1 via 1 Add new Client and 2 Add new invoice...

CVE-2021-43505

Multiple Cross Site Scripting XSS vulnerabilities exist in Ssourcecodester Simple Client Management System v1 via 1 Add new Client and 2 Add new invoice...

CVE-2021-43505

CVE-2021-43505 affects Ssourcecodester Simple Client Management System v1. The vulnerability is described as multiple Cross-Site Scripting (XSS) issues exploitable via adding a new client or adding a new invoice. The connected documents confirm XSS in this product/version combination; no explicit...

CVE-2021-43505

Multiple Cross Site Scripting XSS vulnerabilities exist in Ssourcecodester Simple Client Management System v1 via 1 Add new Client and 2 Add new invoice...

Simple Client Management System 跨站脚本漏洞

Simple Client Management System is a Simple Client Management System by Carlo Montero Personal Developer. A security vulnerability exists in Simple Client Management System v1, which stems from cross-site scripting that may result from 1 adding a new client and 2 adding a new invoice...

CVE-2022-1032

Insecure deserialization of not validated module file in GitHub repository crater-invoice/crater prior to 6.0.6...

Deserialization of untrusted data

Insecure deserialization of not validated module file in GitHub repository crater-invoice/crater prior to 6.0.6...

CVE-2022-1032

CVE-2022-1032 affects the Crater Invoice Crater project prior to 6.0.6, reported as insecure deserialization of unvalidated module files. The exploit path demonstrated in the documents involves uploading a manipulated Phar archive (phar.phar) via the web API, then triggering remote code execution...

CVE-2022-1032 Insecure deserialization of not validated module file in crater-invoice/crater

Insecure deserialization of not validated module file in GitHub repository crater-invoice/crater prior to 6.0.6...

Crater Invoice Crater 代码问题漏洞

Crater Invoice Crater is an open source web and mobile application from Crater Invoice, Inc. for tracking expenses, payments and creating professional invoices and estimates. A security vulnerability exists in Crater Invoice Crater versions prior to 6.0.6 that stems from insecure deserialization ...

CVE-2022-1033

Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6...

CVE-2022-1033

Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6...

CVE-2022-1033

CVE-2022-1033 affects crater-invoice/crater prior to 6.0.6 where there is no restriction on uploading dangerous file types. A PoC shows uploading a PHP webshell as an expense receipt, resulting in a stored file retrievable via attachment_receipt_url (e.g., /storage/50/2137webshell.php), enabling ...

CVE-2022-1033 Unrestricted Upload of File with Dangerous Type in crater-invoice/crater

Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6...

GitHub repository crater-invoice/crater 代码问题漏洞

GitHub is a suite of hosting platforms for open source and private software projects. A security vulnerability exists in the GitHub repository crater-invoice/crater prior to version 6.0.6, which stems from the application's lack of an upload restriction for dangerous types of files...