Supersmart.me - Walk Through CVEs and Security Vulnerabilities

Vulnerabilities (Supersmart.me - Walk Through)

CVE-2022-34768

Synel - eHarmony Stored XSS

insert HTML / js code inside input how to get to the vulnerable input : Workers > worker nickname > inject in this input the code.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Supersmart

Products

Supersmart.me - Walk Through

CVE-2022-30628

Supersmart.me – Walk Through access to business information without authentication

It was possible to download all receipts without authentication. Must first access the API https://XXXX.supersmart.me/services/v4/customer/signin to get a TOKEN. Then you can then access the API that provides invoice images based on the URL https://XXXX.supersmart.me/services/v4/invoiceImg?orderId=XXXXX

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed