CVE-2024-23879: falha de alta gravidade em Cups Easy (Purchase & Inventory)
Cross-Site Scripting (XSS) vulnerability in Cups Easy
Publicada em · Atualizada em
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.2epss 0.4%
probabilidade de exploração
0.4%top 68% das CVEs
exploração observada
nãonenhuma fonte reporta
A vulnerability has been reported in Cups Easy (Purchase & Inventory), version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting (XSS) vulnerability via /cupseasylive/statemodify.php, in the description parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Produtos afetados
Cups Easy · Cups Easy (Purchase & Inventory)CVEs relacionadas — Cups Easy (Purchase & Inventory)
No mesmo produto, das mais perigosas para as menos.
CVE-2024-23895HIGHCross-Site Scripting (XSS) vulnerability in Cups EasyEPSS 0.5%CVE-2024-23896HIGHCross-Site Scripting (XSS) vulnerability in Cups EasyEPSS 0.5%CVE-2024-23894HIGHCross-Site Scripting (XSS) vulnerability in Cups EasyEPSS 0.4%CVE-2024-23893HIGHCross-Site Scripting (XSS) vulnerability in Cups EasyEPSS 0.4%CVE-2024-23891HIGHCross-Site Scripting (XSS) vulnerability in Cups EasyEPSS 0.4%CVE-2024-23882HIGHCross-Site Scripting (XSS) vulnerability in Cups EasyEPSS 0.4%