CVE-2021-21260

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-21260
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-21260.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-21260
Related
  • GHSA-rm79-5596-r7q4
Published
2021-01-22T18:15:12.610Z
Modified
2026-04-10T04:29:34.304017Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

Online Invoicing System (OIS) is open source software which is a lean invoicing system for small businesses, consultants and freelancers created using AppGini. In OIS version 4.0 there is a stored XSS which can enables an attacker takeover of the admin account through a payload that extracts a csrf token and sends a request to change password. It has been found that Item description is reflected without sanitization in app/items_view.php which enables the malicious scenario.

References

Affected packages

Git / github.com/bigprof-software/online-invoicing-system

Affected ranges

Type
GIT
Repo
https://github.com/bigprof-software/online-invoicing-system
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
18522835aa2b23c5376bc1c68ef727f41f334f79
Fixed
4e4d8d0a4017f0b3d56b281b47223785dcb7ffec
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.0"
        }
    ]
}

Affected versions

2.*
2.3
2.4
2.5
2.6
2.9
3.*
3.0
3.1
4.*
4.0
4.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-21260.json"