Cradle eCommerce EUVD-2026-29057

No special conditions required for initial XSS execution - Cradle eCommerce /product/ endpoint is network-accessible without authentication (AV:N/PR:N confirmed by CVSS). However, the UI:A (user interaction required) condition is CRITICAL: successful exploitation requires the target user to visit an attacker-supplied URL or click a link. Exploitation is limited by: (1) lack of persistence - reflected XSS affects only the individual user whose browser processes the reflected payload, not other site visitors; (2) session-scope impact - the injected script runs in the context of the victim's session only; (3) browser same-origin policy - cannot directly access user data outside the Cradle domain. Default configurations with no input filtering or output encoding on /product/ are vulnerable; any deployment of the latest demo version with this endpoint exposed is at risk. Non-demo/production versions may have different vulnerability status and should be individually assessed.

CVSS score of 5.1 with AV:N/AC:L/PR:N/UI:A vector indicates moderate severity with network accessibility and no authentication barrier, but the UI:A (user interaction required) flag significantly limits real-world risk. The vulnerability requires a victim to click an attacker-supplied link or visit a crafted page, which is lower impact than stored XSS or exploitation without user action. EPSS score not provided, limiting probability estimation. CVSS scope (S:X) is undefined in provided vector, creating ambiguity about whether impact is confined to user session or affects other users/systems. No KEV (CISA Known Exploited Vulnerabilities) status indicated, and no POC availability confirmed, suggesting limited active exploitation at time of reporting. Risk is MODERATE to LOW: reflected XSS in demo/latest version suggests lower production deployment density compared to stable release versions; patch availability further reduces practical risk for deployed instances. Primary concern is any production usage of demo versions, which is atypical but possible in development environments.

An attacker crafts a malicious URL containing JavaScript payload in a /product/ parameter (e.g., /product/?id=<script>alert('xss')</script>) and sends it via phishing email or posts it on social media. When a victim clicks the link, the endpoint reflects the unencoded script into the HTML response, causing the attacker's JavaScript to execute in the victim's browser context, potentially stealing session cookies, stealing credentials, or redirecting to malicious sites. The attack succeeds only if the victim actually visits the malicious URL.