A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /invoicing/app/invoices_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: INCIBE

Published: 2023-11-30T13:52:56.136Z

Updated: 2024-08-02T08:28:21.986Z

Reserved: 2023-11-30T10:45:57.546Z

Link: CVE-2023-6427

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2023-11-30T14:15:20.700

Modified: 2023-12-02T04:38:35.270

Link: CVE-2023-6427

cve-icon Redhat

No data.