CVE-2020-35676

BigProf Online Invoicing System before 3.1 fails to correctly sanitize an XSS payload when a user registers using the self-registration functionality. As such, an attacker can input a crafted payload that will execute upon the application's administrator browsing the registered users' list. Once the arbitrary Javascript is executed in the context of the admin, this will cause the attacker to gain administrative privileges, effectively leading into an application takeover. This affects app/membership_signup.php and app/admin/pageViewMembers.php.

• CWE-79

• https://github.com/bigprof-software/online-invoicing-system/releases/tag/3.1Third Party Advisory
• https://labs.ingredous.com/2020/07/13/ois-membershipsignup-xss/Exploit, Third Party Advisory
• https://github.com/bigprof-software/online-invoicing-system/releases/tag/3.1Third Party Advisory
• https://labs.ingredous.com/2020/07/13/ois-membershipsignup-xss/Exploit, Third Party Advisory

Published

Dec 24, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-35667JetBrains TeamCity Plugin before 2020.2.85695 SSRF. Vulnerab…7.5
• CVE-2020-35668RedisGraph 2.x through 2.2.11 has a NULL Pointer Dereference…7.5
• CVE-2020-35669An issue was discovered in the http package through 0.12.2 f…6.1
• CVE-2020-3567A vulnerability in the management REST API of Cisco Industri…6.5
• CVE-2020-35674BigProf Online Invoicing System before 2.9 suffers from an u…9.8
• CVE-2020-35675BigProf Online Invoicing System before 3.0 offers a function…8.8
• CVE-2020-35677BigProf Online Invoicing System before 4.0 fails to adequate…4.8
• CVE-2020-35678Autobahn|Python before 20.12.3 allows redirect header inject…6.1
• CVE-2020-35679smtpd/table.c in OpenSMTPD before 6.8.0p1 lacks a certain re…7.5
• CVE-2020-3568A vulnerability in the antispam protection mechanisms of Cis…5.8
• CVE-2020-35680smtpd/lka_filter.c in OpenSMTPD before 6.8.0p1, in certain c…7.5
• CVE-2020-35681Django Channels 3.x before 3.0.3 allows remote attackers to …7.4