EUVD-2026-53866
GHSA-v3xj-274f-qh28
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
PR:L confirmed by required authenticated access; S:C reflects cross-user script execution impact; no availability impact applies to stored XSS.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Logo Software Industry and Trade Inc. E-Logo Purchasing Portal allows Stored XSS.
This issue affects e-Logo Purchasing Portal: before 1.52.
AnalysisAI
Stored XSS in E-Logo Purchasing Portal (all versions before 1.52) by Logo Software Industry and Trade Inc. permits authenticated low-privilege users to inject persistent malicious scripts that execute in the browsers of other portal users. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold a valid, low-privilege authenticated account on the E-Logo Purchasing Portal (confirmed by PR:L in the CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 5.4 (Medium) is internally consistent: network-reachable (AV:N), low attack complexity (AC:L), low privileges required (PR:L), user interaction required (UI:R), and scope changed (S:C) with low confidentiality and integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding a low-privilege supplier or requester account on the E-Logo Purchasing Portal submits a crafted purchase order entry or comment field containing a JavaScript payload (e.g., a cookie-stealing script). The payload is stored in the portal database and rendered without sanitization when a procurement administrator or approver opens the affected record. … |
| Remediation | Upgrade E-Logo Purchasing Portal to version 1.52 or later, which is confirmed as the remediated release per the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0769. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today