Cups Easy cross-site scripting vulnerability (CNVD-2024-11131)

2024-01-3000:00:00

China National Vulnerability Database

www.cnvd.org.cn

cups easy

php

cross-site scripting

vulnerability

insufficient escaping

authentication

credentials

attacker

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.4%

JSON

Cups Easy is a PHP-based purchasing and inventory software that may become a full-fledged ERP in the future. Cups Easy suffers from a cross-site scripting vulnerability that stems from insufficient escaping of the description parameter on the /cupseasylive/currencylist.php page. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.

CPENameOperatorVersion
cups easy cups easy veq1.0

CPE	Name	Operator	Version
	cups easy cups easy v	eq	1.0