Cups Easy cross-site scripting vulnerability (CNVD-2024-11149)

2024-01-3000:00:00

China National Vulnerability Database

www.cnvd.org.cn

cups easy

php

cross-site scripting

vulnerability

parameter escaping

stock issuance

credential theft

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

25.2%

JSON

Cups Easy is a PHP-based purchasing and inventory software that may become a full-fledged ERP in the future. Cups Easy suffers from a cross-site scripting vulnerability that stems from insufficient escaping of the issuancecreate parameter on the /cupseasylive/stockissuancecreate.php page. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.