CVE-2023-36346

Deeper analysis

POS Codekop v2.0 contains a reflected cross-site scripting vulnerability tracked as CVE-2023-36346. The flaw exists in the nm_member parameter of print.php and is categorized as CWE-79 with a CVSS 3.1 base score of 6.1 reflecting network attack vector, low complexity, no required privileges, required user interaction, and changed scope.

An unauthenticated attacker can supply a malicious payload via the nm_member parameter in a crafted URL to print.php. When a victim follows the link, the script executes in the victim's browser within the application's origin, enabling limited impacts on confidentiality and integrity such as session token theft or unauthorized actions in the changed security context.

The provided references consist of public disclosure posts and proof-of-concept material but contain no statements on patches or mitigation steps. The associated EPSS score has remained flat at 0.0944 with no observed rise after publication.