CVE-2026-64828

Name of the Vulnerable Software and Affected Versions Froiden TableTrack versions prior to 1.3.11

Description A stored cross-site scripting issue exists where unauthenticated attackers can inject arbitrary HTML and JavaScript. This occurs because the order notes field does not properly sanitize input. An attacker can include malicious payloads during customer order placement, which then execute within the administrator's browser session when order details are viewed. This can lead to the theft of session tokens or the execution of unauthorized administrative actions.

Recommendations Update Froiden TableTrack to version 1.3.11 or later.