EUVD-2026-47733
GHSA-9hp2-rmjj-5mmh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated submission (AV:N/PR:N), scope changes to admin browser session (S:C), admin must view order (UI:R), session theft yields low confidentiality and integrity impact; no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Froiden TableTrack through 1.3.10 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary HTML and JavaScript through the order notes field without sanitization. Attackers can craft malicious payloads in customer order placement that execute in the admin's browser session when viewing order details, enabling session token theft or unauthorized administrative actions.
AnalysisAI
Stored cross-site scripting in Froiden TableTrack through version 1.3.10 enables unauthenticated attackers to plant persistent JavaScript payloads via the customer order notes field, which execute in the admin's browser session when order details are reviewed. The attack vector is entirely unauthenticated - any visitor can submit an order containing a crafted payload - while the impact lands on the privileged admin context, enabling session token theft or unauthorized administrative actions. A publicly available proof-of-concept exploit exists; no CISA KEV listing has been confirmed at time of analysis.
Technical ContextAI
TableTrack is a commercial SaaS restaurant management solution sold via CodeCanyon (CPE: cpe:2.3:a:froiden:tabletrack:*:*:*:*:*:*:*:*), providing order management, table tracking, and administrative workflows. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the stored variant: the order notes field accepts arbitrary HTML and JavaScript from the customer-facing order submission form without server-side sanitization or output encoding, and the raw value is later rendered in the admin order-detail view. Unlike reflected XSS, stored XSS persists in the database and fires each time any administrator loads the affected order record - no further attacker interaction is required after initial payload submission.
RemediationAI
No vendor-released patch with a confirmed fix version has been identified at time of analysis. Operators should monitor the VulnCheck advisory (https://www.vulncheck.com/advisories/froiden-tabletrack-stored-xss-via-order-notes-field) and contact Froiden directly for patch availability. As immediate compensating controls: implement server-side HTML tag stripping or allowlist-based sanitization on the order notes field at ingest time - this prevents payload persistence and is the highest-impact mitigation, though it may break any legitimate rich-text formatting in notes. Deploy a strict Content Security Policy (CSP) header in the admin panel that disallows inline scripts (default-src 'self'; script-src 'self'), which limits XSS execution impact even if a payload reaches the admin view. Additionally, apply context-aware output encoding when rendering order notes in the admin template so that stored content is always treated as data, not markup. These controls address the root cause (unsanitized input) and defense-in-depth layers independently.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today