Cross-Site Scripting (XSS) vulnerability in Cups Easy
Vulnerability Description
A vulnerability has been reported in Cups Easy (Purchase & Inventory), version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting (XSS) vulnerability via /cupseasylive/locationcreate.php, in the locationid parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-23895
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Rafael Pedrero
More from Cups Easy
View All →Affected Vendor
Cups Easy
View all reports →