CVE-2024-23870: Cups Easy (Purchase & Inventory) · Cross-site Scripting
Affects Cups Easy (Purchase & Inventory)Source CVE Database V5
Not known to be exploited · CVSS 8.2 High.
Data as of 26 Oct 2026, 08:11 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 37% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 26 Jan 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Cups Easy Cups Easy (Purchase & Inventory) | Affected
| Fixed in– |
AI-suggested
European organizations should implement immediate compensating controls to reduce risk until a vendor patch is available. These include: 1) Employing Web Application Firewalls (WAFs) with custom rules to detect and block malicious payloads targeting the 'delete' parameter on /cupseasylive/stockissuancelist.php. 2) Conducting user awareness training focused on phishing and social engineering to reduce the likelihood of users clicking malicious links. 3) Enforcing strict session management policies such as short session timeouts and multi-factor authentication to limit the impact of stolen session cookies. 4) Reviewing and restricting access to the vulnerable application to trusted networks or VPNs where feasible. 5) Monitoring application logs for unusual access patterns or repeated attempts to exploit the 'delete' parameter. 6) If possible, applying input validation and output encoding at the application layer as an immediate code-level mitigation. Organizations should also engage with the vendor for timely patch releases and verify the deployment of updates once available.
Description
A vulnerability has been reported in Cups Easy (Purchase & Inventory), version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting (XSS) vulnerability via /cupseasylive/stockissuancelist.php, in the delete parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.