PT-2022-20218

Name of the Vulnerable Software and Affected Versions Supersmart affected versions not specified Description The issue allows downloading all receipts without authentication. To exploit this, an attacker must first access the API endpoint "https://XXXX.supersmart.me/services/v4/customer/signin" t...

CVE-2022-30628: Undefined Security Weakness

It was possible to download all receipts without authentication. Must first access the API https://XXXX.supersmart.me/services/v4/customer/signin to get a TOKEN. Then you can then access the API that provides invoice images based on the URL...