E Commerce Pack
Monthly
Stored cross-site scripting in E-Commerce Pack versions 4.5.001 through 28082026 (Akilli Ticaret Software Technologies Ltd.) allows an authenticated low-privilege attacker to inject persistent malicious scripts that execute in other users' browsers, with a confirmed scope change affecting victim browser sessions. The CVSS S:C flag indicates impact escapes the vulnerable application boundary, enabling session hijacking, credential theft, or unauthorized actions performed as the victim. No vendor patch is available - the vendor did not respond to TR-CERT's coordinated disclosure - and no public exploit or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in Softtr E-Commerce Pack (all versions before 5.03.01.49) allows unauthenticated remote attackers to inject malicious script-related HTML tags into rendered web pages, requiring victim interaction to trigger execution. The flaw is rooted in CWE-80 (Improper Neutralization of Script-Related HTML Tags), enabling integrity abuse such as session hijacking, credential phishing, or checkout-flow manipulation within affected storefronts. No public exploit code or active exploitation has been identified at time of analysis.
Cross-site request forgery in Softtr E-Commerce Pack (all versions through build 30072026) allows a remote attacker to force an authenticated user's browser into performing unintended state-changing actions, with high confidentiality and integrity impact per the CVSS vector. No public exploit identified at time of analysis, and the flaw is not on CISA KEV; however, exploitation only requires tricking a logged-in user into visiting a malicious page (UI:R). The vendor was contacted by TR-CERT but did not respond, so no fix is available.
Stored cross-site scripting in E-Commerce Pack versions 4.5.001 through 28082026 (Akilli Ticaret Software Technologies Ltd.) allows an authenticated low-privilege attacker to inject persistent malicious scripts that execute in other users' browsers, with a confirmed scope change affecting victim browser sessions. The CVSS S:C flag indicates impact escapes the vulnerable application boundary, enabling session hijacking, credential theft, or unauthorized actions performed as the victim. No vendor patch is available - the vendor did not respond to TR-CERT's coordinated disclosure - and no public exploit or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in Softtr E-Commerce Pack (all versions before 5.03.01.49) allows unauthenticated remote attackers to inject malicious script-related HTML tags into rendered web pages, requiring victim interaction to trigger execution. The flaw is rooted in CWE-80 (Improper Neutralization of Script-Related HTML Tags), enabling integrity abuse such as session hijacking, credential phishing, or checkout-flow manipulation within affected storefronts. No public exploit code or active exploitation has been identified at time of analysis.
Cross-site request forgery in Softtr E-Commerce Pack (all versions through build 30072026) allows a remote attacker to force an authenticated user's browser into performing unintended state-changing actions, with high confidentiality and integrity impact per the CVSS vector. No public exploit identified at time of analysis, and the flaw is not on CISA KEV; however, exploitation only requires tricking a logged-in user into visiting a malicious page (UI:R). The vendor was contacted by TR-CERT but did not respond, so no fix is available.