CVE-2023-6435

Cross-site Scripting vulnerability in BigProf products

A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /inventory/batches_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bigprof

Products

Online Invoicing System

CVE-2023-6434

Cross-site Scripting vulnerability in BigProf products

A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /inventory/sections_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bigprof

Products

Online Invoicing System

CVE-2023-6431

Cross-site Scripting vulnerability in BigProf products

A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /inventory/categories_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bigprof

Products

Online Invoicing System

CVE-2023-6430

Cross-site Scripting vulnerability in BigProf products

A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /inventory/transactions_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bigprof

Products

Online Invoicing System

CVE-2023-6429

Cross-site Scripting vulnerability in BigProf products

A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /invoicing/app/clients_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bigprof

Products

Online Invoicing System

CVE-2023-6427

Cross-site Scripting vulnerability in BigProf products

A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /invoicing/app/invoices_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bigprof

Products

Online Invoicing System

CVE-2023-6426

Cross-site Scripting vulnerability in BigProf products

A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /invoicing/app/invoices_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bigprof

Products

Online Invoicing System

CVE-2023-6424

Cross-site Scripting vulnerability in BigProf products

A vulnerability has been discovered in BigProf Online Clinic Management System 2.2, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /clinic/disease_symptoms_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bigprof

Products

Online Clinic Management System

CVE-2023-6423

Cross-site Scripting vulnerability in BigProf products

A vulnerability has been discovered in BigProf Online Clinic Management System 2.2, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /clinic/events_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bigprof

Products

Online Clinic Management System

CVE-2023-6422

Cross-site Scripting vulnerability in BigProf products

A vulnerability has been discovered in BigProf Online Clinic Management System 2.2, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /clinic/patients_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bigprof

Products

Online Clinic Management System

CVE-2023-6419

Cross-site Scripting vulnerability in Voovi Social Networking Script

A vulnerability has been reported in Voovi Social Networking Script version 1.0 that allows a XSS via editprofile.php in multiple parameters, the exploitation of which could allow a remote attacker to send a specially crafted JavaScript payload and partially take over the browser session of an authenticated user.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Aatifaneeq

Products

Voovi

CVE-2023-6418

SQL injection in Voovi Social Networking Script

A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via videos.php in the id parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Aatifaneeq

Products

Voovi

CVE-2023-6416

SQL injection in Voovi Social Networking Script

A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via signup2.php in the emailadd parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Aatifaneeq

Products

Voovi

CVE-2023-6415

SQL injection in Voovi Social Networking Script

A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via signin.php in the user parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Aatifaneeq

Products

Voovi

CVE-2023-6414

SQL injection in Voovi Social Networking Script

A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via perfil.php in the id and user parameters. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Aatifaneeq

Products

Voovi

CVE-2023-6413

SQL injection in Voovi Social Networking Script

A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via photos.php in the id and user parameters. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Aatifaneeq

Products

Voovi

CVE-2023-6412

SQL injection in Voovi Social Networking Script

A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via photo.php in multiple parameters. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Aatifaneeq

Products

Voovi

CVE-2023-6410

SQL injection in Voovi Social Networking Script

A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via editprofile.php in multiple parameters. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Aatifaneeq

Products

Voovi

CVE-2023-6401

NotePad++ dbghelp.exe uncontrolled search path

A vulnerability classified as problematic was found in NotePad++ up to 8.1. Affected by this vulnerability is an unknown functionality of the file dbghelp.exe. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The identifier VDB-246421 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Notepad-plus-plus

Products

Notepad\+\+

CVE-2023-6381

Improper input validation in Newsletter Software SuperMailer

Improper input validation vulnerability in Newsletter Software SuperMailer affecting version 11.20.0.2204. An attacker could exploit this vulnerability by sending a malicious configuration file (file with SMB extension) to a user via a link or email attachment and persuade the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to crash the application when attempting to load the malicious file.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Supermailer

Products

Supermailer