Vulnerability · Published Nov 30, 2023 · Assigned by INCIBE
CVE-2023-6435Cross-site Scripting vulnerability in BigProf products
Medium 6.3
In plain English
A medium-severity cross-site scripting in Online Inventory Manager from BigProf . There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).
Official description
A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /inventory/batches_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| BigProf | Online Inventory Manager | 3.2 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L