CVE-2026-3319
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
The latest demo version of the Cradle eCommerce platform contains a reflected Cross-Site Scripting (XSS) vulnerability in the /collection/ endpoint. User-controlled input is insecurely reflected in the HTML output, allowing an attacker to execute arbitrary JavaScript code.
Risk Assessment
An attacker can execute arbitrary JavaScript in the victim's browser, potentially hijacking the session or credentials. This can lead to account takeover and data theft.
Recommendation
Implement proper output encoding and input validation in the /collection/ endpoint. Update the platform to a version where the vulnerability is fixed.
Other vulnerabilities in Cradle eCommerce
See all- CVE-2026-3320Medium
The latest demo version of the Cradle eCommerce platform contains a reflected Cross-Site Scripting (XSS) vulnerability in the /product/ endpoint. User-controlled input is insecurely reflected in the HTML output, allowing an attacker to execute arbitrary JavaScript code.
- CVE-2026-3318Medium
The latest demo version of the Cradle eCommerce platform contains an open redirection vulnerability in the login form endpoint. The 'returnUrl' parameter allows redirection because the application accepts a URL as a parameter without proper validation, enabling redirection of users from the legitimate website to external pages.
Original NVD description (English source)
Reflected Cross-Site Scripting (XSS) in the latest demo version of the Cradle eCommerce platform. User-controlled input is insecurely reflected in the HTML output in the endpoint /collection/. Exploitation of this vulnerability would allow an attacker to execute arbitrary JavaScript code.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS