Ticimax E Commerce Platform
Monthly
Reflected cross-site scripting in the Ticimax E-Commerce Platform (builds through 2026-10-20) lets remote attackers inject script into pages served to victims who follow a crafted link, potentially stealing session cookies, hijacking authenticated storefront or admin sessions, or rewriting page content to phish customers. Unauthenticated attackers can craft the URL (CVSS:3.1/PR:N), but the payload only executes when a victim actively opens it (UI:R), and the scope change (S:C) means impact lands in the victim's browser origin rather than the server itself, which is why the score sits at 6.1 rather than critical. No public exploit code and no confirmed active exploitation were identified at time of analysis; EPSS and KEV data were not provided, so the practical risk is driven by targeted social-engineering delivery against storefront users or administrators.
Reflected cross-site scripting in the Ticimax E-Commerce Platform (builds through 2026-10-20) lets remote attackers inject script into pages served to victims who follow a crafted link, potentially stealing session cookies, hijacking authenticated storefront or admin sessions, or rewriting page content to phish customers. Unauthenticated attackers can craft the URL (CVSS:3.1/PR:N), but the payload only executes when a victim actively opens it (UI:R), and the scope change (S:C) means impact lands in the victim's browser origin rather than the server itself, which is why the score sits at 6.1 rather than critical. No public exploit code and no confirmed active exploitation were identified at time of analysis; EPSS and KEV data were not provided, so the practical risk is driven by targeted social-engineering delivery against storefront users or administrators.