CVE-2020-6583

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-6583
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-6583.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-6583
Published
2020-01-08T20:15:13.030Z
Modified
2026-03-14T10:33:43.840759Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

BigProf Online Invoicing System (OIS) through 2.6 has XSS that can be leveraged for session hijacking. An attacker can exploit the XSS vulnerability, retrieve the session cookie from the administrator login, and take over the administrator account via the Name field in an Add New Client action.

References

Affected packages

Git / github.com/bigprof-software/online-invoicing-system

Affected ranges

Type
GIT
Repo
https://github.com/bigprof-software/online-invoicing-system
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
5550ad6bb16cbcd33c4eb6d22b7adc5b45e33b42
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.6"
        }
    ]
}

Affected versions

2.*
2.3
2.4
2.5
2.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-6583.json"