Cups Easy cross-site scripting vulnerability (CNVD-2024-11139)

2024-01-3000:00:00

China National Vulnerability Database

www.cnvd.org.cn

cups easy

php

cross-site scripting

vulnerability

theft

authentication.

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.3%

JSON

Cups Easy is a PHP-based purchasing and inventory software that may become a full-fledged ERP in the future. Cups Easy suffers from a cross-site scripting vulnerability that stems from insufficient escaping of the itemid parameter on the /cupseasylive/itemcreate.php page. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.

CPENameOperatorVersion
cups easy cups easy veq1.0

CPE	Name	Operator	Version
	cups easy cups easy v	eq	1.0