Security Advisory

CVE-2021-21260

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2021-01-22 17:20:15

Last updated 2024-08-03 18:09:15

Assigner GitHub_M

State PUBLISHED

Description

Online Invoicing System (OIS) is open source software which is a lean invoicing system for small businesses, consultants and freelancers created using AppGini. In OIS version 4.0 there is a stored XSS which can enables an attacker takeover of the admin account through a payload that extracts a csrf token and sends a request to change password. It has been found that Item description is reflected without sanitization in app/items_view.php which enables the malicious scenario.

← Browse all CVEs View on cve.org ↗