CVE-2026-5790
Stored Cross-Site Scripting (XSS) vulnerability in Stel Order
- State
- Published
- Severity
- 5.1 Medium
- Published
- May 14, 2026
- Updated
- May 14, 2026
- Reserved
- Apr 8, 2026
Description
Stored Cross-Site Scripting (XSS) in Stel Order v3.25.1 and earlier, located at the ‘/app/FrontController’ endpoint via the ‘legalName’ and ‘employeeID’ parameters. The lack of proper input sanitization allows an attacker to inject malicious code that is persistently stored in the database. When other users or administrators access the affected sections, the code executes in their browsers, enabling the theft of session cookies and account hijacking.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N | INCIBE |
Weaknesses
- CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')
Affected Products
| Product | Versions |
|---|---|
Stel OrderStel Order |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.