E Commerce Pack
Monthly
Cross-site request forgery in Softtr E-Commerce Pack (all versions through build 30072026) allows a remote attacker to force an authenticated user's browser into performing unintended state-changing actions, with high confidentiality and integrity impact per the CVSS vector. No public exploit identified at time of analysis, and the flaw is not on CISA KEV; however, exploitation only requires tricking a logged-in user into visiting a malicious page (UI:R). The vendor was contacted by TR-CERT but did not respond, so no fix is available.
Reflected cross-site scripting in Akıllı Ticaret Software Technologies Ltd. Co. E-Commerce Pack allows unauthenticated remote attackers to inject arbitrary script into pages generated by the application, which executes in the browser of any user who opens a crafted link. All versions up to and including 2026-10-06 are considered affected, and exploitation requires victim interaction (a click on the attacker-supplied URL), limiting the attack to session cookie theft, credential phishing, or DOM manipulation within the victim's browser rather than server compromise. CVE-2026-12380 is rated CVSS 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) and was reported by TR-CERT; the vendor was contacted but did not respond, so no vendor patch is available and no public exploit code was identified at time of analysis. Treat this as a low-to-moderate real-world priority rather than an urgent threat.
Account enumeration in Softtr Informatics Trading Limited Company's E-Commerce Pack lets unauthenticated remote attackers determine whether specific user accounts exist by observing differing responses from login, registration, or password-recovery functions. All versions up to and including the 2026-10-02 release are affected, and exploitation requires only network reachability to an instance that actually fronts a user-account system on the public internet - no credentials or user interaction are needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). Impact is limited to confidentiality of account-existence data (C:L, no integrity or availability effect), so this is a low-to-moderate priority information-disclosure issue and reconnaissance aid rather than a direct compromise path; no public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS data was not provided.
Stored cross-site scripting in E-Commerce Pack versions 4.5.001 through 28082026 (Akilli Ticaret Software Technologies Ltd.) allows an authenticated low-privilege attacker to inject persistent malicious scripts that execute in other users' browsers, with a confirmed scope change affecting victim browser sessions. The CVSS S:C flag indicates impact escapes the vulnerable application boundary, enabling session hijacking, credential theft, or unauthorized actions performed as the victim. No vendor patch is available - the vendor did not respond to TR-CERT's coordinated disclosure - and no public exploit or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in Softtr E-Commerce Pack (all versions before 5.03.01.49) allows unauthenticated remote attackers to inject malicious script-related HTML tags into rendered web pages, requiring victim interaction to trigger execution. The flaw is rooted in CWE-80 (Improper Neutralization of Script-Related HTML Tags), enabling integrity abuse such as session hijacking, credential phishing, or checkout-flow manipulation within affected storefronts. No public exploit code or active exploitation has been identified at time of analysis.
Cross-site request forgery in Softtr E-Commerce Pack (all versions through build 30072026) allows a remote attacker to force an authenticated user's browser into performing unintended state-changing actions, with high confidentiality and integrity impact per the CVSS vector. No public exploit identified at time of analysis, and the flaw is not on CISA KEV; however, exploitation only requires tricking a logged-in user into visiting a malicious page (UI:R). The vendor was contacted by TR-CERT but did not respond, so no fix is available.
Reflected cross-site scripting in Akıllı Ticaret Software Technologies Ltd. Co. E-Commerce Pack allows unauthenticated remote attackers to inject arbitrary script into pages generated by the application, which executes in the browser of any user who opens a crafted link. All versions up to and including 2026-10-06 are considered affected, and exploitation requires victim interaction (a click on the attacker-supplied URL), limiting the attack to session cookie theft, credential phishing, or DOM manipulation within the victim's browser rather than server compromise. CVE-2026-12380 is rated CVSS 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) and was reported by TR-CERT; the vendor was contacted but did not respond, so no vendor patch is available and no public exploit code was identified at time of analysis. Treat this as a low-to-moderate real-world priority rather than an urgent threat.
Account enumeration in Softtr Informatics Trading Limited Company's E-Commerce Pack lets unauthenticated remote attackers determine whether specific user accounts exist by observing differing responses from login, registration, or password-recovery functions. All versions up to and including the 2026-10-02 release are affected, and exploitation requires only network reachability to an instance that actually fronts a user-account system on the public internet - no credentials or user interaction are needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). Impact is limited to confidentiality of account-existence data (C:L, no integrity or availability effect), so this is a low-to-moderate priority information-disclosure issue and reconnaissance aid rather than a direct compromise path; no public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS data was not provided.
Stored cross-site scripting in E-Commerce Pack versions 4.5.001 through 28082026 (Akilli Ticaret Software Technologies Ltd.) allows an authenticated low-privilege attacker to inject persistent malicious scripts that execute in other users' browsers, with a confirmed scope change affecting victim browser sessions. The CVSS S:C flag indicates impact escapes the vulnerable application boundary, enabling session hijacking, credential theft, or unauthorized actions performed as the victim. No vendor patch is available - the vendor did not respond to TR-CERT's coordinated disclosure - and no public exploit or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in Softtr E-Commerce Pack (all versions before 5.03.01.49) allows unauthenticated remote attackers to inject malicious script-related HTML tags into rendered web pages, requiring victim interaction to trigger execution. The flaw is rooted in CWE-80 (Improper Neutralization of Script-Related HTML Tags), enabling integrity abuse such as session hijacking, credential phishing, or checkout-flow manipulation within affected storefronts. No public exploit code or active exploitation has been identified at time of analysis.