Read the docs
TI-2021-04362 Aliases CVE-2021-21260

XSS in description field

Priority LOW 34CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Online Invoicing System (OIS) is open source software which is a lean invoicing system for small businesses, consultants and freelancers created using AppGini. In OIS version 4.0 there is a stored XSS which can enables an attacker takeover of the admin account through a payload that extracts a csrf token and sends a request to change password. It has been found that Item description is reflected without sanitization in app/items_view.php which enables the malicious scenario.

Why it matters now

EPSS 0.00603 49th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
bigprof-softwareonline-invoicing-system= 4.0—No fix listedCNA
  • online-invoicing-system Vendorbigprof-software Affected = 4.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:bigprof:online_invoicing_system:4.0:*:*:*:*:*:*:*4.0VulnerableBigProf
  • cpe:2.3:a:bigprof:online_invoicing_system:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·BigProf

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-21260

References

Exploit 1

Advisory 1

  • TI-2020-18145 BigProf Online Invoicing System before 2.9 suffers from an unauthenticated SQL Injection… CVSS 3.1CRITICAL 9.8
  • TI-2020-18146 BigProf Online Invoicing System before 3.0 offers a functionality that allows an… CVSS 3.1HIGH 8.8
  • TI-2020-18147 BigProf Online Invoicing System before 3.1 fails to correctly sanitize an XSS payload… CVSS 3.1MEDIUM 6.1
  • TI-2023-05905 Cross-site Scripting vulnerability in BigProf products CVSS 3.1MEDIUM 6.3
  • TI-2023-05904 Cross-site Scripting vulnerability in BigProf products CVSS 3.1MEDIUM 6.3
  • TI-2023-05903 Cross-site Scripting vulnerability in BigProf products CVSS 3.1MEDIUM 6.3
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences