CVE-2026-4264CWE-79cross-site-scripting

CVE-2026-4264

published October 9, 2026

CVSS
5.1
EPSS
0%
Percentile
23.7
In the wild
Unconfirmed
What it is

Reflected Cross-Site Scripting (XSS) on the BeeTienda e-commerce platform, specifically in the latest demo version. The incident occurs due to a lack of proper sanitization of user input data in the 'search' parameter of the product list endpoint. When malicious payloads are transmitted via the 'search' parameter, they are displayed insecurely in the HTML response, allowing for the arbitrary execution of JavaScript code in the victim's browser.

The record
Technical detail
CVSS
5.1 · NONE
CVSS v4.0
5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00320 · 23.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-10-09T12:16Z
References (1)
https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-beetienda-ecommerce-platform · [email protected]
EPSS history
Timeline
  • 10 OCT 03:29Z
    EPSS moved — → 0%
    epss
  • 09 OCT 07:43Z
    Reflected Cross-Site Scripting in BeeTienda eCommerce platform
    cvelistv5
  • 09 OCT 07:43Z
    Reflected Cross-Site Scripting in BeeTienda eCommerce platform
    cvelistv5