CVE-2024-23862: Cups Easy (Purchase & Inventory) · Cross-site Scripting
Affects Cups Easy (Purchase & Inventory)Source CVE Database V5
Not known to be exploited · CVSS 8.2 High.
Data as of 26 Oct 2026, 17:16 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 33% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 26 Jan 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Cups Easy Cups Easy (Purchase & Inventory) | Affected
| Fixed in– |
AI-suggested
- Immediate mitigation should include implementing strict input validation and output encoding on the 'grnno' parameter to neutralize malicious scripts. Until an official patch is available, organizations should consider deploying Web Application Firewalls (WAFs) with custom rules to detect and block suspicious payloads targeting the vulnerable endpoint.
- Enforce the use of secure, HttpOnly, and SameSite cookie attributes to reduce the risk of session cookie theft via XSS.
- Conduct user awareness training focused on recognizing phishing attempts and suspicious URLs to reduce the likelihood of successful social engineering.
- Restrict access to the Cups Easy application to trusted networks or VPNs where feasible, minimizing exposure to external attackers.
- Monitor web server and application logs for unusual requests to /cupseasylive/grndisplay.php with suspicious parameters.
- Plan for rapid deployment of patches once released by the vendor and consider application-level mitigations such as Content Security Policy (CSP) headers to limit script execution.
- Review session management policies to ensure sessions expire appropriately and consider multi-factor authentication to reduce the impact of session hijacking.
Description
A vulnerability has been reported in Cups Easy (Purchase & Inventory), version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting (XSS) vulnerability via /cupseasylive/grndisplay.php, in the grnno parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.