What’s Vulnerable › Vulnerabilities

CVE-2022-30628: Supersmart.me – Walk Through access to business information without authentication

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-07-21 · updated 2026-06-17

Description

It was possible to download all receipts without authentication. Must first access the API https://XXXX.supersmart.me/services/v4/customer/signin to get a TOKEN. Then you can then access the API that provides invoice images based on the URL https://XXXX.supersmart.me/services/v4/invoiceImg?orderId=XXXXX

Affected products

• Supersmart.me – Walk Through: all versions

References

• https://www.gov.il/en/Departments/faq/cve_advisories
• https://www.gov.il/en/Departments/faq/cve_advisories

Get alerted when CVE-2022-30628 or the next vulnerability affects your stack