EUVD-2026-42546
GHSA-7qpx-wmf3-25cj
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-accessible reflected XSS requires no privileges or auth, but mandates victim interaction; scope change and low C/I impact match standard reflected XSS impact bounds.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
1DescriptionCVE.org
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Inrove Software and Internet Services BiEticaret allows Reflected XSS.
This issue affects BiEticaret: before v3.3.57.
AnalysisAI
Reflected cross-site scripting in BiEticaret, a Turkish e-commerce platform by Inrove Software and Internet Services, enables remote unauthenticated attackers to inject and execute malicious JavaScript in victims' browsers by tricking them into clicking a crafted URL. All versions prior to v3.3.57 are affected across the full product line. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept has been identified at time of analysis; however, the low attack complexity and absence of authentication requirements make this straightforward to exploit once a target is socially engineered.
Technical ContextAI
BiEticaret is a web-based e-commerce platform developed by Inrove Software and Internet Services, identified by CPE cpe:2.3:a:inrove_software_and_internet_services:bieticaret:*:*:*:*:*:*:*:*. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), the canonical root cause for reflected XSS. In a reflected XSS pattern, attacker-controlled input - typically embedded in a URL query parameter - is echoed back into the HTTP response without adequate encoding or sanitization, causing the victim's browser to interpret it as executable script rather than inert data. The CVSS scope change indicator (S:C) confirms the injected code breaks out of the application's origin and can affect the victim's browser session context, enabling attacks such as session token theft, credential harvesting via fake forms, or redirecting to malicious domains.
RemediationAI
The primary fix is to upgrade BiEticaret to version v3.3.57 or later, which resolves the improper input neutralization. Administrators should apply this update immediately, referencing the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0519 for update guidance. If an immediate upgrade is not possible, a compensating control is to deploy a Web Application Firewall (WAF) rule set to detect and block reflected XSS payloads in HTTP request parameters; note this introduces a dependency on WAF signature quality and may produce false positives on legitimate inputs. Additionally, configuring a strict Content-Security-Policy (CSP) header to restrict inline script execution can significantly reduce the impact of any successful XSS injection, though it does not eliminate the underlying vulnerability. Operators handling payment data should treat this as elevated priority given the e-commerce context.
More in Bieticaret
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today