PatchTheCVEexpress invoice vulnerabilities and fixes
Recent CVEs affecting express invoice, with upgrade or downgrade steps. 4 tracked.
Also searched as: expressinvoice.
express invoice has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 1. Most recent: 2020-12-28. Highest priority: CVE-2020-11561 (score 56/100).
- CVE-2020-13476 MEDIUM 4.8 UPGRADE NCH Express Invoice 8.06 to 8.24 is vulnerable to Reflected XSS in the Quotes List module.
- CVE-2020-11561 HIGH 8.8 DOWNGRADE In NCH Express Invoice 7.25, an authenticated low-privilege user can enter a crafted URL to access higher-priv
- CVE-2020-11560 HIGH 7.8 DOWNGRADE NCH Express Invoice 7.25 allows local users to discover the cleartext password by reading the configuration fi
- CVE-2019-16282 MEDIUM 5.4 DOWNGRADE In NCH Express Invoice v7.12, persistent cross site scripting (XSS) exists via the Invoices/Items/Customers/Qu
FAQ
How do I fix express invoice vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is express invoice being exploited right now?
None of the tracked express invoice CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which express invoice CVE should I patch first?
CVE-2020-11561 currently ranks highest (56/100): In NCH Express Invoice 7.25, an authenticated low-privilege user can enter a crafted URL to access higher-priv.