CVE-2023-6430

Cross-site Scripting vulnerability in BigProf products

A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /inventory/transactions_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bigprof

Products

Online Invoicing System

CVE-2023-6429

Cross-site Scripting vulnerability in BigProf products

A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /invoicing/app/clients_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bigprof

Products

Online Invoicing System

CVE-2023-6427

Cross-site Scripting vulnerability in BigProf products

A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /invoicing/app/invoices_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bigprof

Products

Online Invoicing System

CVE-2023-6426

Cross-site Scripting vulnerability in BigProf products

A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /invoicing/app/invoices_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bigprof

Products

Online Invoicing System

CVE-2023-6424

Cross-site Scripting vulnerability in BigProf products

A vulnerability has been discovered in BigProf Online Clinic Management System 2.2, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /clinic/disease_symptoms_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bigprof

Products

Online Clinic Management System

CVE-2023-6423

Cross-site Scripting vulnerability in BigProf products

A vulnerability has been discovered in BigProf Online Clinic Management System 2.2, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /clinic/events_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bigprof

Products

Online Clinic Management System

CVE-2023-6422

Cross-site Scripting vulnerability in BigProf products

A vulnerability has been discovered in BigProf Online Clinic Management System 2.2, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /clinic/patients_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bigprof

Products

Online Clinic Management System

CVE-2023-6419

Cross-site Scripting vulnerability in Voovi Social Networking Script

A vulnerability has been reported in Voovi Social Networking Script version 1.0 that allows a XSS via editprofile.php in multiple parameters, the exploitation of which could allow a remote attacker to send a specially crafted JavaScript payload and partially take over the browser session of an authenticated user.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Aatifaneeq

Products

Voovi

CVE-2023-6418

SQL injection in Voovi Social Networking Script

A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via videos.php in the id parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Aatifaneeq

Products

Voovi

CVE-2023-6416

SQL injection in Voovi Social Networking Script

A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via signup2.php in the emailadd parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Aatifaneeq

Products

Voovi

CVE-2023-6415

SQL injection in Voovi Social Networking Script

A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via signin.php in the user parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Aatifaneeq

Products

Voovi

CVE-2023-6414

SQL injection in Voovi Social Networking Script

A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via perfil.php in the id and user parameters. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Aatifaneeq

Products

Voovi

CVE-2023-6413

SQL injection in Voovi Social Networking Script

A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via photos.php in the id and user parameters. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Aatifaneeq

Products

Voovi

CVE-2023-6412

SQL injection in Voovi Social Networking Script

A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via photo.php in multiple parameters. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Aatifaneeq

Products

Voovi

CVE-2023-6410

SQL injection in Voovi Social Networking Script

A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via editprofile.php in multiple parameters. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Aatifaneeq

Products

Voovi

CVE-2023-6401

NotePad++ dbghelp.exe uncontrolled search path

A vulnerability classified as problematic was found in NotePad++ up to 8.1. Affected by this vulnerability is an unknown functionality of the file dbghelp.exe. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The identifier VDB-246421 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Notepad-plus-plus

Products

Notepad\+\+

CVE-2023-6381

Improper input validation in Newsletter Software SuperMailer

Improper input validation vulnerability in Newsletter Software SuperMailer affecting version 11.20.0.2204. An attacker could exploit this vulnerability by sending a malicious configuration file (file with SMB extension) to a user via a link or email attachment and persuade the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to crash the application when attempting to load the malicious file.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Supermailer

Products

Supermailer

CVE-2023-6380

Open Redirect in Alkacon Software OpenCms

Open redirect vulnerability has been found in the Open CMS product affecting versions 14 and 15 of the 'Mercury' template. An attacker could create a specially crafted URL and send it to a specific user to redirect them to a malicious site and compromise them. Exploitation of this vulnerability is possible due to the fact that there is no proper sanitization of the 'URI' parameter.

CVSS 3.1 · 6.1 Medium EPSS 1.6% KEV · Not listed

Vendors

Alkacon

Products

Opencms

CVE-2023-6379

Cross-site Scripting in Alkacon Software OpenCms

Cross-site scripting (XSS) vulnerability in Alkacon Software Open CMS, affecting versions 14 and 15 of the 'Mercury' template. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload to a victim and partially take control of their browsing session.

CVSS 3.1 · 5.4 Medium EPSS 1.8% KEV · Not listed

Vendors

Alkacon

Products

Opencms

CVE-2023-6376

Henschen & Associates court document management software cache uses predictable file names

Henschen & Associates court document management software does not sufficiently randomize file names of cached documents, allowing a remote, unauthenticated attacker to access restricted documents.

CVSS 3.1 · 5.3 Medium EPSS 1.1% KEV · Not listed

Vendors

Henschen

Products

Court Document Management