Vulnerabilities

TI-2020-10569 CVE-2020-13476 · GHSA-2jvv-ppmq-fvgf

NCH Express Invoice 8.06 to 8.24 is vulnerable to Reflected XSS in the Quotes List module.

LOW 23

NCH Express Invoice 8.06 to 8.24 is vulnerable to Reflected XSS in the Quotes List module.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00688 Published 2020-12-28 No fix listed CWE-79

TI-2020-09278 CVE-2020-11561 · GHSA-5rmh-f225-qfjh

In NCH Express Invoice 7.25, an authenticated low-privilege user can enter a crafted URL…

MEDIUM 42

In NCH Express Invoice 7.25, an authenticated low-privilege user can enter a crafted URL to access higher-privileged functionalities such as the "Add New Item" screen.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02206 Published 2020-04-07 No fix listed CWE-425

TI-2020-09277 CVE-2020-11560 · GHSA-5rwc-h8m7-5hcc

NCH Express Invoice 7.25 allows local users to discover the cleartext password by reading the configuration file.

LOW 36

NCH Express Invoice 7.25 allows local users to discover the cleartext password by reading the configuration file.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00999 Published 2020-04-07 No fix listed CWE-522

TI-2019-12256 CVE-2019-16282 · GHSA-cwwh-h7c4-5x27

In NCH Express Invoice v7.12, persistent cross site scripting (XSS) exists via the…

LOW 25

In NCH Express Invoice v7.12, persistent cross site scripting (XSS) exists via the Invoices/Items/Customers/Quotes input field.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00581 Published 2019-10-14 No fix listed CWE-79

Vulnerabilities

Filters

NCH Express Invoice 8.06 to 8.24 is vulnerable to Reflected XSS in the Quotes List module.

In NCH Express Invoice 7.25, an authenticated low-privilege user can enter a crafted URL…

NCH Express Invoice 7.25 allows local users to discover the cleartext password by reading the configuration file.

In NCH Express Invoice v7.12, persistent cross site scripting (XSS) exists via the…