Skip to content
OpenAdvisories
Unscored CVE-2019-16330 EUVD-2019-7110GHSA-95j3-4qj7-3qrm

In NCH Express Accounts Accounting v7.02, persistent cross site scripting (XSS) exists in Invoices/Sales Orders/Items/Customers/Quotes inpu…

Published Oct 17, 2019 · Updated Aug 5, 2024 · Assigned by mitre

Description

In NCH Express Accounts Accounting v7.02, persistent cross site scripting (XSS) exists in Invoices/Sales Orders/Items/Customers/Quotes input field. An authenticated unprivileged user can add/modify the Invoices/Sales Orders/Items/Customers/Quotes fields parameter to inject arbitrary JavaScript.

References