CVE-2026-4264: Reflected Cross-Site Scripting in BeeTienda eCommerce platform
Reflected Cross-Site Scripting (XSS) on the BeeTienda e-commerce platform, specifically in the latest demo version. The incident occurs due to a lack of proper sanitization of user input data in the 'search' parameter of the product list endpoint. When malicious payloads are transmitted via the 'search' parameter, they are displayed insecurely in the HTML response, allowing for the arbitrary execution of JavaScript code in the victim's browser.
Affected Software
Event History
Frequently Asked Questions
Which deployments are confirmed to be affected?
The issue is reported in the latest demo version of the BeeTienda e-commerce platform. No other versions or deployment types are identified in the available information.
What does an attacker need to exploit this issue?
An attacker needs to send a malicious payload through the product list endpoint's search parameter and cause a victim to load the resulting response. The payload is reflected into the HTML response and can execute JavaScript in the victim's browser.
How can I check whether my instance is vulnerable?
Test the product list endpoint's search parameter with a harmless marker and inspect whether the value is returned in the HTML response without proper output encoding or sanitization. The reported vulnerable behavior is insecure reflection of search input into the page.