Cross Site Scripting (XSS) vulnerability in InvoicePlane 1.6 via filter_product input to file modal_product_lookups.php.
References
Link | Resource |
---|---|
https://gist.github.com/enferas/e4ab1aedd9727c3b09c7d0154a052199 | Exploit Third Party Advisory |
https://gist.github.com/enferas/e8fff9261526fdf51808c39b3004e1b5 | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
15 Feb 2023, 19:41
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
CWE | CWE-79 | |
References | (MISC) https://gist.github.com/enferas/e8fff9261526fdf51808c39b3004e1b5 - Exploit, Third Party Advisory | |
References | (MISC) https://gist.github.com/enferas/e4ab1aedd9727c3b09c7d0154a052199 - Exploit, Third Party Advisory | |
CPE | cpe:2.3:a:invoiceplane:invoiceplane:1.6.0:beta1:*:*:*:*:*:* cpe:2.3:a:invoiceplane:invoiceplane:1.6.0:beta3:*:*:*:*:*:* cpe:2.3:a:invoiceplane:invoiceplane:1.6.0:beta:*:*:*:*:*:* cpe:2.3:a:invoiceplane:invoiceplane:1.6.0:-:*:*:*:*:*:* cpe:2.3:a:invoiceplane:invoiceplane:1.6.0:beta2:*:*:*:*:*:* |
|
First Time |
Invoiceplane
Invoiceplane invoiceplane |
07 Feb 2023, 23:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-02-07 23:15
Updated : 2023-12-10 14:48
NVD link : CVE-2023-23011
Mitre link : CVE-2023-23011
CVE.ORG link : CVE-2023-23011
JSON object : View
Products Affected
invoiceplane
- invoiceplane
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')