Ecommerce Platform
Monthly
Reflected cross-site scripting in the BeeTienda e-commerce platform allows a remote attacker to execute arbitrary JavaScript in a victim's browser via the product list endpoint's 'search' parameter, which is reflected without proper sanitization. INCIBE-CERT reports the flaw in the latest demo version, and exploitation requires the victim to click an attacker-crafted link while the impact is confined to the victim's browser session rather than the server. No public exploit code was identified at time of analysis, and the issue is rated medium severity (CVSS 4.0 base 5.1).
Reflected cross-site scripting in the BeeTienda e-commerce platform allows a remote attacker to execute arbitrary JavaScript in a victim's browser via the product list endpoint's 'search' parameter, which is reflected without proper sanitization. INCIBE-CERT reports the flaw in the latest demo version, and exploitation requires the victim to click an attacker-crafted link while the impact is confined to the victim's browser session rather than the server. No public exploit code was identified at time of analysis, and the issue is rated medium severity (CVSS 4.0 base 5.1).