What’s Vulnerable › Vulnerabilities

CVE-2020-6583

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-01-08 · updated 2026-06-17
• Weakness: CWE-79

Description

BigProf Online Invoicing System (OIS) through 2.6 has XSS that can be leveraged for session hijacking. An attacker can exploit the XSS vulnerability, retrieve the session cookie from the administrator login, and take over the administrator account via the Name field in an Add New Client action.

Affected products

• BigProf Online Inventory Manager: through 2.6

References

• https://www.sevenlayers.com/index.php/282-online-invoicing-system-2-6-xss-session-hijack
• https://www.sevenlayers.com/index.php/282-online-invoicing-system-2-6-xss-session-hijack

Get alerted when CVE-2020-6583 or the next vulnerability affects your stack