EUVD-2026-29056
GHSA-2hwv-x45q-vm8v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Reflected Cross-Site Scripting (XSS) in the latest demo version of the Cradle eCommerce platform. User-controlled input is insecurely reflected in the HTML output in the endpoint /collection/. Exploitation of this vulnerability would allow an attacker to execute arbitrary JavaScript code.
AnalysisAI
Reflected XSS in Cradle eCommerce platform allows unauthenticated remote attackers to execute arbitrary JavaScript in user browsers via unsanitized input reflected in the /collection/ endpoint. The vulnerability requires user interaction (clicking a malicious link) but affects the latest demo version with CVSS 5.1 (low-medium severity). No public exploit code or active exploitation has been identified at time of analysis, though a vendor patch is available.
Technical ContextAI
This is a classic reflected cross-site scripting vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation). The /collection/ endpoint fails to sanitize or encode user-supplied input before rendering it in HTML output, allowing attackers to inject malicious JavaScript that executes in the context of a victim's browser session. The vulnerability exploits the trust relationship between users and the legitimate Cradle application to deliver client-side attacks such as session hijacking, credential theft, or malware delivery. Affected products are identified via CPE a:e-commerce:cradle with all versions matching the wildcard pattern.
RemediationAI
Apply the vendor-released patch available from INCIBE (https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cradle-e-commerce). Exact patched version number is not provided in available data - contact vendor directly or review the advisory for specific version increments. As an immediate compensating control, implement Web Application Firewall (WAF) rules to block requests containing script injection payloads in the /collection/ endpoint parameters, though this may generate false positives if legitimate user input contains angle brackets or JavaScript keywords. Additionally, deploy Content Security Policy (CSP) headers with script-src restrictions to prevent inline script execution even if XSS payload reaches the DOM - this mitigates impact but does not eliminate the root vulnerability. Input validation and output encoding (HTML entity encoding for user input in HTML context) must be implemented in the application code itself to fully resolve CWE-79.
More in E Commerce
View allMultiple SQL injection vulnerabilities in the Welcart e-Commerce plugin 1.3.12 for WordPress allow remote attackers to e
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mAyaNet E-Commerce
Detronetdip E-commerce 1.0.0 contains an authentication bypass vulnerability in the seller account creation endpoint tha
Unrestricted file upload in detronetdip E-commerce 1.0.0 via the /seller/assets/backend/profile/addadhar.php endpoint al
Multiple cross-site scripting (XSS) vulnerabilities in the Welcart e-Commerce plugin 1.3.12 for WordPress allow remote a
Sensitive information disclosure in iKAS Technology Inc.'s E-Commerce platform (all versions through build 03062026) all
An authenticated attacker in SAP E-Commerce (Business-to-Consumer application), versions 7.3, 7.31, 7.32, 7.33, 7.54, ca
A security flaw has been discovered in detronetdip E-commerce 1.0.0. The impacted element is the function Delete/Update
Reflected XSS in AKIN Software E-Commerce (all versions before 1.25.01.06) enables unauthenticated remote attackers to i
SAP E-Commerce (Business-to-Consumer) application does not sufficiently encode user-controlled inputs, resulting in Cros
A weakness has been identified in detronetdip E-commerce 1.0.0. This affects the function get_safe_value of the file uti
Open redirection in Cradle eCommerce login form endpoint allows attackers to redirect authenticated users to arbitrary e
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today