CVE-2023-6428 — Cross-site Scripting vulnerability in BigProf products

Description (CNA)

A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /invoicing/app/items_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.

Affected (CNA)

Vendor / product	Versions
BigProf / Online Invoicing System	affected 2.6

CWE

CWE-79

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-xss-vulnerabilities-bigprof-products

ADP enrichment

CVE

No English description supplied.

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-xss-vulnerabilities-bigprof-products

CISA-ADP

No English description supplied.

No references supplied.