CVE-2024-23865: fallo de gravedad alta en Cups Easy (Purchase & Inventory)
Cross-Site Scripting (XSS) vulnerability in Cups Easy
Publicada el · Actualizada el
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.2epss 0.4%
probabilidad de explotación
0.4%top 64% de las CVE
explotación observada
noninguna fuente lo reporta
A vulnerability has been reported in Cups Easy (Purchase & Inventory), version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting (XSS) vulnerability via /cupseasylive/taxstructurelist.php, in the description parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Productos afectados
Cups Easy · Cups Easy (Purchase & Inventory)CVEs relacionadas — Cups Easy (Purchase & Inventory)
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-23895HIGHCross-Site Scripting (XSS) vulnerability in Cups EasyEPSS 0.5%CVE-2024-23896HIGHCross-Site Scripting (XSS) vulnerability in Cups EasyEPSS 0.5%CVE-2024-23894HIGHCross-Site Scripting (XSS) vulnerability in Cups EasyEPSS 0.4%CVE-2024-23893HIGHCross-Site Scripting (XSS) vulnerability in Cups EasyEPSS 0.4%CVE-2024-23891HIGHCross-Site Scripting (XSS) vulnerability in Cups EasyEPSS 0.4%CVE-2024-23882HIGHCross-Site Scripting (XSS) vulnerability in Cups EasyEPSS 0.4%