Cross-site Scripting vulnerability in BigProf products
Description
A vulnerability has been discovered in BigProf Online Invoicing System 2.6, which does not sufficiently encode user-controlled input, resulting in persistent XSS through /invoicing/app/invoices_view.php, in the FirstRecord parameter. Exploitation of this vulnerability could allow an attacking user to store dangerous JavaScript payloads on the system that will be triggered when the page loads.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Persistent XSS in BigProf Online Invoicing System 2.6 via the FirstRecord parameter in invoices_view.php allows stored JavaScript payloads.
Vulnerability
A persistent cross-site scripting (XSS) vulnerability exists in BigProf Online Invoicing System version 2.6. The application does not sufficiently encode user-controlled input passed to the FirstRecord parameter in the file /invoicing/app/invoices_view.php. This allows an attacker to inject arbitrary JavaScript code that is stored on the server and executed when the page is loaded. The vulnerability is classified as CWE-79 and has a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) [1].
Exploitation
An attacker can exploit this vulnerability by crafting a malicious payload in the FirstRecord parameter and submitting it to the affected page. No authentication is required, but user interaction (e.g., clicking a link or submitting a form) is needed to trigger the storage of the payload. Once stored, the payload executes automatically when any user visits /invoicing/app/invoices_view.php, including administrators [1].
Impact
Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser session. This can lead to session hijacking, defacement of the application interface, theft of sensitive data, or further attacks against other users. The impact is limited to low confidentiality, integrity, and availability compromise as per the CVSS score [1].
Mitigation
As of the publication date (2023-11-30), no official fix or patch has been released by BigProf for this vulnerability. Users are advised to monitor the vendor's website for updates and consider applying input validation and output encoding as a temporary workaround. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog [1].
AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1- Range: 2.6
Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"Insufficient encoding of user-controlled input in the FirstRecord parameter allows stored cross-site scripting."
Attack vector
An attacker can inject a persistent XSS payload by supplying malicious JavaScript in the `FirstRecord` parameter when interacting with `/invoicing/app/invoices_view.php` [ref_id=1]. The application does not sufficiently encode this user-controlled input before storing it, so the payload is saved on the system and executed in the browser of any user who loads the affected page [ref_id=1]. No authentication is required (CVSS:AV:N/AC:L/PR:N), and the attack only requires the victim to view the page (user interaction) [ref_id=1].
Affected code
The vulnerability is in the file `/invoicing/app/invoices_view.php`, specifically in the `FirstRecord` parameter [ref_id=1]. The advisory does not specify the exact function or line number within that file.
What the fix does
No patch or fix has been reported at this time [ref_id=1]. The advisory states that the root cause is the application's failure to sufficiently encode user-controlled input, leading to persistent XSS [ref_id=1]. To remediate the vulnerability, the application must properly encode or sanitize the `FirstRecord` parameter before storing or rendering it in the page.
Preconditions
- inputThe attacker must be able to supply input to the FirstRecord parameter on /invoicing/app/invoices_view.php
- inputA victim user must load the affected page to trigger the stored payload
Generated on May 24, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
1News mentions
0No linked articles in our index yet.