CVE-2026-64828CWE-79cross-site-scripting

CVE-2026-64828

Medium · published July 22, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
29.5
In the wild
Unconfirmed
What it is

Froiden TableTrack through 1.3.10 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary HTML and JavaScript through the order notes field without sanitization. Attackers can craft malicious payloads in customer order placement that execute in the admin's browser session when viewing order details, enabling session token theft or unauthorized administrative actions.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00368 · 29.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-07-22T20:18Z
References (4)
https://codecanyon.net/item/tabletrack-the-complete-saas-restaurant-management-solution/55116396 · [email protected]https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-64828 · [email protected]https://www.vulncheck.com/advisories/froiden-tabletrack-stored-xss-via-order-notes-field · [email protected]http://seclists.org/fulldisclosure/2026/Aug/31 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 22 JUL 15:39Z
    Froiden TableTrack 1.3.10 Stored XSS via Order Notes Field
    cvelistv5