Cups Easy cross-site scripting vulnerability (CNVD-2024-11134)

2024-01-3000:00:00

China National Vulnerability Database

www.cnvd.org.cn

cups easy

php software

cross-site scripting

vulnerability

grnno parameter

authentication credentials

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.4%

JSON

Cups Easy is a PHP-based purchasing and inventory software that may become a full-fledged ERP in the future. Cups Easy suffers from a cross-site scripting vulnerability that stems from insufficient escaping of the grnno parameter on the /cupseasylive/grndisplay.php page. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.

CPENameOperatorVersion
cups easy cups easy veq1.0

CPE	Name	Operator	Version
	cups easy cups easy v	eq	1.0