CVE-2024-23862

Summary

CVE-2024-23862 is a newly reported vulnerability affecting Cups Easy (Purchase & Inventory), version 1.0. This issue involves insufficient encoding of user-controlled inputs, leading to a Cross-Site Scripting (XSS) vulnerability. Attackers can exploit this flaw by crafting malicious URLs, which, when visited by an authenticated user, could allow the attacker to steal their session cookie credentials. The vulnerable component is located in the /cupseasylive/grndisplay.php file, specifically in the grnno parameter.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.