CVE-2020-35675: Bigprof Online Invoicing System

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

BigProf Online Invoicing System before 3.0 offers a functionality that allows an administrator to move the records of members across groups. The applicable endpoint (admin/pageTransferOwnership.php) lacks CSRF protection, resulting in an attacker being able to escalate their privileges to Administrator and effectively taking over the application.

Affected products

• Bigprof Online Invoicing System: before 3.0 (fixed in 3.0)

Published 2022-09-29. Last modified 2026-06-17.