BeeTienda CVE-2026-4264

Exploitation requires the target BeeTienda deployment to expose the product list endpoint whose 'search' parameter is reflected without sanitization, and the victim MUST click an attacker-crafted link (UI:A) while in context of the site - there is no server-side or persistent component. Key LIMITING factors: (1) the flaw is described as present in 'the latest demo version,' so production installations may not be affected - this must be confirmed; (2) impact is confined to the victim's browser session (no server code execution); (3) no authentication is needed by the attacker (PR:N), but delivery depends on social engineering since the payload is reflected, not stored.

This is a medium-severity reflected XSS (CVSS 4.0 base 5.1) in the BeeTienda e-commerce platform, reported by Spain's INCIBE-CERT. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) indicates a network-reachable, low-complexity, unauthenticated flaw that nonetheless REQUIRES victim interaction (UI:A) - the hallmark of reflected XSS, where an attacker must lure a user into clicking a crafted link. Impact metrics are all 'Low' (VC:L/VI:L/SC:L/SI:L), consistent with script execution limited to the victim's browser session rather than server compromise. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The description explicitly scopes the flaw to 'the latest demo version,' which materially lowers real-world risk: if the vulnerable code path exists only in a demo/sandbox deployment rather than production installations, exposure is minimal - verify with the vendor/INCIBE whether production releases are affected. Net assessment: a legitimate but low-priority web hygiene issue; the dependence on user interaction and browser-scoped impact make it far from a 'drop everything' item absent evidence the product is widely deployed.

An attacker crafts a URL to the BeeTienda product list endpoint with a malicious JavaScript payload in the 'search' parameter and delivers it to a victim via phishing email, chat, or a malicious link. When the victim opens the link while browsing the store, the unsanitized payload is reflected into the HTML response and executes in their browser, enabling session cookie theft, UI defacement, or redirection. No public exploit code is identified at time of analysis, and successful attack depends on the victim clicking the attacker-supplied link (UI:A).