CVE-2021-21260 — XSS in description field
Online Invoicing System (OIS) is open source software which is a lean invoicing system for small businesses, consultants and freelancers created using AppGini. In OIS version 4.…
Published: 2021-01-22 · CVSS: 7.6 · CVSS 3.1
Online Invoicing System (OIS) is open source software which is a lean invoicing system for small businesses, consultants and freelancers created using AppGini. In OIS version 4.0 there is a stored XSS which can enables an attacker takeover of the admin account through a payload that extracts a csrf token and sends a request to change password. It has been found that Item description is reflected without sanitization in app/items_view.php which enables the malicious scenario.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7