Online Invoicing System
Approved changes feed: RSS · Atom
cpe:2.3:a:bigprof:online_invoicing_system:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Bigprof (8bd524b4-7cda-52ec-a563-5f91c08b24bb) |
|---|---|
| Product | Online Invoicing System (70e3e6ba-9edb-5025-ac72-360f81d65518) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/bigprof-software/online-invoicing-system |
purl2cpe | 2026-06-01 10:12:49.400514 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-6429 |
vulnerable | 2026-06-08 06:19:47.365418 |
Cross-site Scripting vulnerability in BigProf products
MEDIUM (6.3)
A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /invoicing/app/clients_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.
Published: 2023-11-30T13:54:03.417Z
Updated: 2024-08-02T08:28:21.833Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-6428 |
vulnerable | 2026-06-08 06:19:47.364992 |
Cross-site Scripting vulnerability in BigProf products
MEDIUM (6.3)
A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /invoicing/app/items_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.
Published: 2023-11-30T13:53:42.237Z
Updated: 2025-06-03T13:50:56.399Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-6427 |
vulnerable | 2026-06-08 06:19:47.364471 |
Cross-site Scripting vulnerability in BigProf products
MEDIUM (6.3)
A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /invoicing/app/invoices_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.
Published: 2023-11-30T13:52:56.136Z
Updated: 2024-08-02T08:28:21.986Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-6426 |
vulnerable | 2026-06-08 06:19:47.362731 |
Cross-site Scripting vulnerability in BigProf products
MEDIUM (6.3)
A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /invoicing/app/invoices_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.
Published: 2023-11-30T13:50:17.135Z
Updated: 2024-08-02T08:28:21.793Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-27839 |
vulnerable | 2026-06-08 05:31:22.248426 |
Details available
A CSV injection vulnerability found in Online Invoicing System (OIS) 4.3 and below can be exploited by users to perform malicious actions such as redirecting admins to unknown or harmful websites, or disclosing other clients' details that the user did not have access to.
Published: 2021-03-03T18:11:32.000Z
Updated: 2024-08-03T21:33:16.053Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-6583 |
vulnerable | 2026-06-08 05:26:45.522369 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-35677 |
vulnerable | 2026-06-08 05:25:01.506077 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-35676 |
vulnerable | 2026-06-08 05:25:01.505698 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-35675 |
vulnerable | 2026-06-08 05:25:01.505259 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-35674 |
vulnerable | 2026-06-08 05:25:01.504703 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.