CVE-2024-23889

creationtimestamp| type| source ---|---|--- 2024-02-19 14:51:38+00:00| seen| https://t.me/ctinow/187707...

CVE-2024-23889 Cross-Site Scripting (XSS) vulnerability in Cups Easy

A vulnerability has been reported in Cups Easy Purchase & Inventory, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting XSS vulnerability via /cupseasylive/itemgroupcreate.php, in the itemgroupid parameter. Exploitation of this...

CVE-2024-23889

Cups Easy (Purchase & Inventory) version 1.0 contains a Cross-Site Scripting (XSS) flaw in the /cupseasylive/itemgroupcreate.php endpoint, caused by insufficient encoding of the itemgroupid parameter. An attacker can lure an authenticated user to click a crafted URL, potentially exfiltrating cook...