CVE-2023-6428CWE-79

Cross-site Scripting vulnerability in BigProf products

Medium · published November 30, 2023

CVSS v3.1
6.3
EPSS
0%
Percentile
31.7
In the wild
Unconfirmed
What it is

A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /invoicing/app/items_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00388 · 31.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2023-11-30T13:53Z
EPSS history
Timeline
  • 30 NOV 13:53Z
    Cross-site Scripting vulnerability in BigProf products
    cvelistv5