EUVD Vulnerability Catalog

EUVD-2026-95540

Severity: MEDIUM Base Score: 5.1 CVSS Version: 4.0

Vulnerability Description

Reflected Cross-Site Scripting (XSS) on the BeeTienda e-commerce platform, specifically in the latest demo version. The incident occurs due to a lack of proper sanitization of user input data in the 'search' parameter of the product list endpoint. When malicious payloads are transmitted via the 'search' parameter, they are displayed insecurely in the HTML response, allowing for the arbitrary execution of JavaScript code in the victim's browser.

CVSS Vector Analysis

Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

▪ Attack Vector (AV): Network

▪ Attack Complexity (AC): Low

▪ Attack Requirements (AT): None

▪ Privileges Required (PR): None

▪ User Interaction (UI): Active

▪ Vulnerability Confidentiality Impact (VC): Low

▪ Vulnerability Integrity Impact (VI): Low

▪ Vulnerability Availability Impact (VA): None

▪ Subsequent Confidentiality Impact (SC): Low

▪ Subsequent Integrity Impact (SI): Low

▪ Subsequent Availability Impact (SA): None

Affected Vendors & Systems

Vendor BeeTienda

References & Advisory Links

https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-beetienda-ecommerce-platform

Metadata Profile

Database Authority

European Union Agency for Cybersecurity (ENISA) EUVD

Assigner

INCIBE

EPSS Probability

Known Aliases

GHSA-h2v9-47p7-m85j CVE-2026-4264

Published On

2026-10-09

Last Updated

2026-10-09