CVE-2020-35676

CVE-2020-35676 is a stored Cross-Site Scripting (XSS) vulnerability in BigProf Online Invoicing System versions prior to 3.1. An unauthenticated attacker can inject a malicious payload during self-registration, which executes when an administrator views the registered user list. This allows the attacker to gain administrative privileges, leading to application takeover. The vulnerability has a CVSS score of 6.1 (Medium), indicating a network-based attack with low complexity, requiring user interaction, and resulting in partial confidentiality and integrity impact. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.