CVE-2024-23880 | BDVDB-2026-223095 Detail

Description#

A vulnerability has been reported in Cups Easy (Purchase & Inventory), version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting (XSS) vulnerability via /cupseasylive/taxcodelist.php, in the description parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12024-01-26Record published in the CVE List.
2. Version 22025-05-29Most recent update recorded in the CVE List.