CVE-2021-21260

The CVE-2021-21260 entry describes a stored XSS in Online Invoicing System (OIS) v4.0, caused by unsanitized input reflected in app/items_view.php (Item description). This enables an attacker to potentially takeover an admin account by injecting a payload that extracts a CSRF token and issues a p...

CVE-2020-35677

CVE-2020-35677 affects the BigProf Online Invoicing System (pre-4.0). The vulnerability is a Stored XSS in the group-creation flow via the admin/pageEditGroup.php endpoint, caused by inadequate sanitization of HTML characters. Exploitation requires administrative privileges to create the payload,...

CVE-2020-35676

CVE-2020-35676 affects BigProf Online Invoicing System prior to 3.1. The vulnerability is a cross‑site scripting flaw in the self‑registration flow that fails to sanitize input in the self-registration member form and in the admin view of members (app/membership_signup.php and app/admin/pageViewM...

CVE-2020-6583

CVE-2020-6583 affects BigProf Online Invoicing System (OIS) up to version 2.6. The vulnerability is a cross-site scripting (XSS) flaw that enables an attacker to hijack an administrator session by retrieving the session cookie through the Name field in an Add New Client action. The exploitation p...

CVE-2020-35675

CVE-2020-35675 affects BigProf Online Invoicing System prior to 3.0. The admin/pageTransferOwnership.php endpoint lacks CSRF protection, allowing an attacker to escalate privileges to Administrator and potentially take over the application. Affected component: the transfer ownership function with...

CVE-2020-35674

BigProf Online Invoicing System prior to version 2.9 is affected by an unauthenticated SQL Injection in /membership_passwordReset.php. The root cause is a custom sanitization implementation that fails to properly sanitize input, allowing an attacker to craft a payload to extract sensitive data an...

CVE-2021-27839

CVE-2021-27839 describes a CSV injection vulnerability in Online Invoicing System (OIS) versions 4.3 and earlier. The issue allows authenticated users to inject data via CSV exports that could redirect admins to harmful sites or expose other clients’ data. Root cause is CSV injection in OIS’s exp...

CVE-2023-6432

CVE-2023-6432 affects BigProf Online Invoicing System version 2.6. The vulnerability is a persistent cross-site scripting (XSS) flaw in the FirstRecord parameter of the "/inventory/items_view.php" endpoint, caused by insufficient encoding of user-controlled input. An attacker could store JavaScri...

CVE-2023-6426

BigProf Online Invoicing System 2.6 is affected by a persistent XSS in the FirstRecord parameter of /invoicing/app/invoices_view.php due to insufficient encoding of user-controlled input. Attacker-controlled JavaScript could be stored and executed when the page loads. Public sources in the connec...

CVE-2023-6430

CVE-2023-6430 concerns BigProf Online Invoicing System 2.6. The vulnerability is a persistent XSS flaw caused by insufficient encoding of user-controlled input in the FirstRecord parameter of /inventory/transactions_view.php, enabling an attacker to store JavaScript payloads that execute when the...

CVE-2023-6434

BigProf Online Invoicing System (version 2.6) contains a persistent XSS vulnerability in the FirstRecord parameter of the /inventory/sections_view.php endpoint due to insufficient input encoding. The issue affects the inventory view API endpoint (FirstRecord parameter) and can allow storing malic...

CVE-2023-6435

CVE-2023-6435 affects BigProf Online Invoicing System 2.6. The vulnerability is a persistent XSS in the FirstRecord parameter of the endpoint "/inventory/batches_view.php" due to insufficient input encoding. Exploitation could allow an attacker to store and trigger JavaScript payloads when the pa...

CVE-2023-6428

CVE-2023-6428 affects BigProf Online Invoicing System 2.6. The vulnerability is persistent XSS via the FirstRecord parameter in the /invoicing/app/items_view.php endpoint caused by insufficient input encoding. If exploited, an attacker could store JavaScript payloads that execute when the page lo...

CVE-2023-6429

BigProf Online Invoicing System 2.6 has a persistent XSS in the FirstRecord parameter of /invoicing/app/clients_view.php due to insufficient encoding of user-controlled input. Multiple connected sources (NVD/NVD mirror, CVE records, and third-party references) describe the vulnerability as a cros...

CVE-2023-6431

BigProf Online Invoicing System 2.6 contains a persistent XSS flaw due to insufficient encoding of user-controlled input in the FirstRecord parameter of /inventory/categories_view.php. This could allow storing JavaScript payloads that execute when the page loads. Documented in CVE-2023-6431 and c...

CVE-2023-6427

BigProf Online Invoicing System 2.6 contains a persistent XSS in the FirstRecord parameter of /invoicing/app/invoices_view.php due to insufficient input encoding. Multiple connected sources describe the vulnerability as allowing stored JavaScript payloads to execute when the affected page loads. ...

CVE-2023-6433

CVE-2023-6433 : In BigProf Online Invoicing System 2.6, the FirstRecord parameter of /inventory/suppliers_view.php does not sufficiently encode user-controlled input, allowing persistent XSS. Exploitation could enable an attacker to store JavaScript payloads that execute on page load. Connected s...