Vulnerabilities

TI-2023-18220 CVE-2023-36347 · GHSA-323x-wpgh-r8q4

A broken authentication mechanism in the endpoint excel.php of POS Codekop v2.0 allows…

HIGH 72

A broken authentication mechanism in the endpoint excel.php of POS Codekop v2.0 allows unauthenticated attackers to download selling data.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.34054 Published 2023-06-30 No fix listed CWE-306

TI-2023-18221 CVE-2023-36348 · GHSA-c48q-hvj2-46c7

HIGH 73

POS Codekop v2.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the filename parameter.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.06366 Published 2023-06-23 No fix listed CWE-862

TI-2023-18219 CVE-2023-36346 · GHSA-9qw9-9m4p-h49w

MEDIUM 60

POS Codekop v2.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the nm_member parameter at print.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.05252 Published 2023-06-23 No fix listed CWE-79

TI-2023-18218 CVE-2023-36345 · GHSA-rjq5-jm3q-xr89

HIGH 73

A Cross-Site Request Forgery (CSRF) in POS Codekop v2.0 allows attackers to escalate privileges.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01049 Published 2023-06-23 No fix listed CWE-79