Cups Easy cross-site scripting vulnerability (CNVD-2024-11138)

2024-01-3000:00:00

China National Vulnerability Database

www.cnvd.org.cn

cups easy

php

cross-site scripting

vulnerability

version 1.0

authentication credentials

theft

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.4%

JSON

Cups Easy is a PHP-based purchasing and inventory software that may become a full-fledged ERP in the future. A cross-site scripting vulnerability exists in Cups Easy version 1.0, which stems from insufficient escaping of the grnno parameter on the /cupseasylive/grnprint.php page. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.

CPENameOperatorVersion
cups easy cups easy veq1.0

CPE	Name	Operator	Version
	cups easy cups easy v	eq	1.0