Tabletrack
Monthly
Stored cross-site scripting in Froiden TableTrack through version 1.3.10 enables unauthenticated attackers to plant persistent JavaScript payloads via the customer order notes field, which execute in the admin's browser session when order details are reviewed. The attack vector is entirely unauthenticated - any visitor can submit an order containing a crafted payload - while the impact lands on the privileged admin context, enabling session token theft or unauthorized administrative actions. A publicly available proof-of-concept exploit exists; no CISA KEV listing has been confirmed at time of analysis.
Stored cross-site scripting in Froiden TableTrack through version 1.3.10 enables unauthenticated attackers to plant persistent JavaScript payloads via the customer order notes field, which execute in the admin's browser session when order details are reviewed. The attack vector is entirely unauthenticated - any visitor can submit an order containing a crafted payload - while the impact lands on the privileged admin context, enabling session token theft or unauthorized administrative actions. A publicly available proof-of-concept exploit exists; no CISA KEV listing has been confirmed at time of analysis.