EUVD-2026-38445
GHSA-ch8h-w2pf-cfh9
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-accessible reflected XSS needing no attacker auth (PR:N), but UI:R for victim click; S:C for browser-context scope change; no availability impact.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
2DescriptionCVE.org
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd. E-Commerce allows Reflected XSS.
This issue affects e-Commerce: before 1.25.01.06.
AnalysisAI
Reflected XSS in AKIN Software E-Commerce (all versions before 1.25.01.06) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into following a crafted URL. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms network-reachable exploitation requiring no authentication, with a scope change indicating script execution in the browser context outside the originating document. Reported by TR-CERT; no public exploit code or CISA KEV listing identified at time of analysis.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: user-supplied HTTP request parameters are reflected back into the HTML response without adequate output encoding or sanitization, allowing injected script content to be interpreted by the victim's browser. The affected product, identified by CPE cpe:2.3:a:akin_software_computer_import_export_industry_and_trade_ltd.:e-commerce:*:*:*:*:*:*:*:*, is an e-commerce platform developed by AKIN Software Computer Import Export Industry and Trade Ltd., a Turkish software vendor. Reflected XSS differs from stored XSS in that the payload is not persisted server-side - it must be delivered fresh via a crafted URL on each exploitation attempt, requiring attacker-controlled delivery to targeted users.
RemediationAI
Upgrade AKIN Software E-Commerce to version 1.25.01.06 or later, as confirmed in the CVE description and TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0427. If immediate patching is not feasible, deploy a Web Application Firewall (WAF) rule to block reflected XSS payloads in request parameters - note this is a compensating control, not a fix, and sophisticated encoding bypasses may circumvent WAF detection. Additionally, implement a strict Content Security Policy (CSP) header disabling inline script execution (script-src 'self'); this limits the impact of any reflected content but may require testing against legitimate site functionality. For admin-facing endpoints, restrict access by IP allowlist to reduce the attacker's ability to target privileged sessions.
More in E Commerce
View allMultiple SQL injection vulnerabilities in the Welcart e-Commerce plugin 1.3.12 for WordPress allow remote attackers to e
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mAyaNet E-Commerce
Detronetdip E-commerce 1.0.0 contains an authentication bypass vulnerability in the seller account creation endpoint tha
Unrestricted file upload in detronetdip E-commerce 1.0.0 via the /seller/assets/backend/profile/addadhar.php endpoint al
Multiple cross-site scripting (XSS) vulnerabilities in the Welcart e-Commerce plugin 1.3.12 for WordPress allow remote a
Sensitive information disclosure in iKAS Technology Inc.'s E-Commerce platform (all versions through build 03062026) all
An authenticated attacker in SAP E-Commerce (Business-to-Consumer application), versions 7.3, 7.31, 7.32, 7.33, 7.54, ca
A security flaw has been discovered in detronetdip E-commerce 1.0.0. The impacted element is the function Delete/Update
SAP E-Commerce (Business-to-Consumer) application does not sufficiently encode user-controlled inputs, resulting in Cros
A weakness has been identified in detronetdip E-commerce 1.0.0. This affects the function get_safe_value of the file uti
Open redirection in Cradle eCommerce login form endpoint allows attackers to redirect authenticated users to arbitrary e
Reflected cross-site scripting (XSS) in Cradle eCommerce platform allows unauthenticated remote attackers to execute arb
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today