CVE-2023-36346
MediumCVSS 6.1Exploitation Probability (EPSS)
High risk87th percentile - higher than 87% of all known CVEs
Summary
Version 2.0 of POS Codekop was found to contain a reflected XSS vulnerability via the nm_member parameter in print.php.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious JavaScript code, potentially leading to user data theft or session hijacking.
Recommendation
It is recommended to update the POS Codekop system to the latest version and to validate and sanitize input data in the application.
Other vulnerabilities in POS Codekop v2.0
See all- CVE-2023-36347High
A broken authentication mechanism in the endpoint excel.php of POS Codekop v2.0 allows unauthenticated attackers to download selling data.
- CVE-2023-36348High
Version 2.0 of POS Codekop has an authenticated remote code execution (RCE) vulnerability via the filename parameter.
- CVE-2023-36345High
A Cross-Site Request Forgery (CSRF) in POS Codekop v2.0 allows attackers to escalate privileges.
Original NVD description (English source)
POS Codekop v2.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the nm_member parameter at print.php.