CVE-2023-6435
Published Nov 30, 2023A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /inventor…
Vendor archive
bigprof CVEs
Beta · best-effort22 CVEs tagged to vendor bigprof — 1 Critical, 2 High, 19 Medium, 0 Low, 0 Unrated.
CVE-2023-6434
Published Nov 30, 2023A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /inventor…
CVE-2023-6433
Published Nov 30, 2023A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /inventor…
CVE-2023-6432
Published Nov 30, 2023A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /inventor…
CVE-2023-6431
Published Nov 30, 2023A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /inventor…
CVE-2023-6430
Published Nov 30, 2023A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /inventor…
CVE-2023-6429
Published Nov 30, 2023A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /invoicin…
CVE-2023-6428
Published Nov 30, 2023A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /invoicin…
CVE-2023-6427
Published Nov 30, 2023A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /invoicin…
CVE-2023-6426
Published Nov 30, 2023A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /invoicin…
CVE-2023-6425
Published Nov 30, 2023A vulnerability has been discovered in BigProf Online Clinic Management System 2.2, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /…
CVE-2023-6424
Published Nov 30, 2023A vulnerability has been discovered in BigProf Online Clinic Management System 2.2, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /…
CVE-2023-6423
Published Nov 30, 2023A vulnerability has been discovered in BigProf Online Clinic Management System 2.2, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /…
CVE-2023-6422
Published Nov 30, 2023A vulnerability has been discovered in BigProf Online Clinic Management System 2.2, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /…
CVE-2020-35675
Published Sep 29, 2022BigProf Online Invoicing System before 3.0 offers a functionality that allows an administrator to move the records of members across groups. The applicable endpoint (admin/pageTra…
CVE-2020-35674
Published Sep 29, 2022BigProf Online Invoicing System before 2.9 suffers from an unauthenticated SQL Injection found in /membership_passwordReset.php (the endpoint that is responsible for issuing self-…
CVE-2021-27839
Published Mar 3, 2021A CSV injection vulnerability found in Online Invoicing System (OIS) 4.3 and below can be exploited by users to perform malicious actions such as redirecting admins to unknown or…
CVE-2021-21260
Published Jan 22, 2021Online Invoicing System (OIS) is open source software which is a lean invoicing system for small businesses, consultants and freelancers created using AppGini. In OIS version 4.0…
CVE-2020-35677
Published Dec 24, 2020BigProf Online Invoicing System before 4.0 fails to adequately sanitize fields for HTML characters upon an administrator using admin/pageEditGroup.php to create a new group, resul…
CVE-2020-35676
Published Dec 24, 2020BigProf Online Invoicing System before 3.1 fails to correctly sanitize an XSS payload when a user registers using the self-registration functionality. As such, an attacker can inp…
CVE-2020-6583
Published Jan 8, 2020BigProf Online Invoicing System (OIS) through 2.6 has XSS that can be leveraged for session hijacking. An attacker can exploit the XSS vulnerability, retrieve the session cookie f…
CVE-2018-18587
Published Oct 23, 2018BigProf AppGini 5.70 stores the passwords in the database using the MD5 hash.
Showing 1-22 of 22 CVEsPage 1 of 1