CVSS 3.1 Score 8.2 of 10 (high)


Published Jan 26, 2024
Updated: Feb 15, 2024


A vulnerability, identified as CVE-2024-23896, has been reported in Cups Easy (Purchase & Inventory), version 1.0. This vulnerability allows user-controlled inputs to be insufficiently encoded, resulting in a Cross-Site Scripting (XSS) vulnerability through the batchno parameter in the /cupseasylive/stock.php URL. Exploiting this vulnerability could enable a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials. The affected product is Cups Easy version 1.0, and to remediate this vulnerability, it is recommended to update to a patched version when available or apply any security patches provided by the vendor. This vulnerability poses a high danger to organizations as it can lead to unauthorized access and compromise of sensitive information due to the potential for session hijacking.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-23896 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options