CVE-2023-6434

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-6434
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-6434.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-6434
Published
2023-11-30T14:15:23.393Z
Modified
2026-03-14T12:23:25.000534Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /inventory/sections_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.

References

Affected packages

Git / github.com/bigprof-software/online-invoicing-system

Affected ranges

Type
GIT
Repo
https://github.com/bigprof-software/online-invoicing-system
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
5550ad6bb16cbcd33c4eb6d22b7adc5b45e33b42
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.6"
        }
    ]
}

Affected versions

2.*
2.3
2.4
2.5
2.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-6434.json"