CVE-2026-64828

MEDIUM SEVERITY

CVSS Score & Metrics

Base Score

6.1 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N                                    

Vulnerability Description

Froiden TableTrack through 1.3.10 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary HTML and JavaScript through the order notes field without sanitization. Attackers can craft malicious payloads in customer order placement that execute in the admin's browser session when viewing order details, enabling session token theft or unauthorized administrative actions.

Vulnerability Details

Published Date

July 22, 2026

Last Modified

July 22, 2026

CWE ID

CWE-79

Source

NVD

Vendor

Froiden

Product

TableTrack

External References

https://codecanyon.net/item/tabletrack-the-complete-saas-restaurant-management-solution/55116396
https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-64828
https://www.vulncheck.com/advisories/froiden-tabletrack-stored-xss-via-order-notes-field

CVE-2026-64828

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment