CVE-2024-23857

CVSS 3.1 Score 6.1 of 10 (medium)

Details

Published Jan 26, 2024
Updated: Feb 15, 2024
CWE ID 79

Summary

CVE-2024-23857 is a newly reported vulnerability affecting Cups Easy (Purchase & Inventory), version 1.0. The issue stems from insufficient input encoding in the /cupseasylive/grnlinecreate.php file, which leads to a Cross-Site Scripting (XSS) vulnerability. If successfully exploited, this flaw enables a remote attacker to craft a malicious URL and trick an authenticated user into visiting it, ultimately resulting in the theft of their session cookie credentials.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share