CVE-2021-3005

MK-AUTH through 19.01 K4.9 allows remote attackers to obtain sensitive information e.g., a CPF number via a modified titulo aka invoice number value to the central/recibo.php URI...

CVE-2021-43505

Multiple Cross Site Scripting XSS vulnerabilities exist in Ssourcecodester Simple Client Management System v1 via 1 Add new Client and 2 Add new invoice...

CVE-2020-16194

An Insecure Direct Object Reference IDOR vulnerability was found in Prestashop Opart devis 4.0.2. Unauthenticated attackers can have access to any user's invoice and delivery address by exploiting an IDOR on the deliveryaddress and invoiceaddress fields...

CVE-2020-11561

In NCH Express Invoice 7.25, an authenticated low-privilege user can enter a crafted URL to access higher-privileged functionalities such as the "Add New Item" screen...

CVE-2016-11006

The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admininit settings changes...

CVE-2016-11011

The wp-invoice plugin before 4.1.1 for WordPress has wpiupdateuseroption privilege escalation...

CVE-2017-1000466

Invoice Ninja version 3.8.1 is vulnerable to stored cross-site scripting vulnerability, within the invoice creation page, which can result in disruption of service and execution of javascript code...

CVE-2016-11008

The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpipaypal payer metadata updates...

CVE-2016-11009

The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpiinterkassa payer metadata updates...

CVE-2013-3814

Unspecified vulnerability in the Oracle Retail Invoice Matching component in Oracle Industry Applications 10.2, 11.0, 12.0, 12.0IN, 12.1, 13.0, 13.1, and 13.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to System Administration...

CVE-2016-11010

The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpitwocheckout payer metadata updates...

CVE-2016-11007

The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpiuserid for invoice retrieval...

Spam campaign targeting Brazil abuses Remote Monitoring and Management tools

Cisco Talos identified a spam campaign targeting Brazilian users with commercial remote monitoring and management RMM tools since at least January 2025. Talos observed the use of PDQ Connect and N-able remote access tools in this campaign. The spam message uses the Brazilian electronic invoice...

WordPress plugin Woocommerce Automatic Order Printing 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exist...

A Blockchain-Based Approach for Secure and Transparent E-Faktur Issuance in Indonesia'S VAT Reporting System

The implementation of blockchain technology in tax administration offers promising improvements in security, transparency, and efficiency. This paper presents the design of a blockchain-based e-Faktur system aimed at addressing the challenges of issuing and verifying tax invoices within Indonesia...

CashBook 安全漏洞

CashBook is a payment program from CashBook India. A security vulnerability exists in CashBook version 4.0.3, which originates from /api/entry/flow/invoice/show?invoice=Arbitrary file read exists...

CVE-2025-27980

The set of connected records confirm CVE-2025-27980 affects CashBook v4.0.3, where an arbitrary file read is possible through the API endpoint /api/entry/flow/invoice/show?invoice=. The vulnerability exposes confidential data (CVE metrics indicate Confidentiality Impact: High, Integrity: Low, Ava...

CVE-2025-3186

A vulnerability was found in projectworlds Online Doctor Appointment Booking System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /patient/invoice.php. The manipulation of the argument appid leads to sql injection. The attack can be...

PT-2025-14818 · Unknown · Projectworlds Online Doctor Appointment Booking System

Name of the Vulnerable Software and Affected Versions: projectworlds Online Doctor Appointment Booking System version 1.0 Description: A critical issue was found in the projectworlds Online Doctor Appointment Booking System. The vulnerability affects an unknown functionality of the file...

CVE-2025-2715

A vulnerability classified as problematic has been found in timschofield webERP up to 5.0.0.rc+13. This affects an unknown part of the file ConfirmDispatchInvoice.php of the component Confirm Dispatch and Invoice Page. The manipulation of the argument Narrative leads to cross site scripting. It i...