{"id":"CVE-2026-3320","state":"PUBLISHED","title":"Multiple vulnerabilities in Cradle e-commerce","description":"Reflected Cross-Site Scripting (XSS) in the latest demo version of the Cradle eCommerce platform. User-controlled input is insecurely reflected in the HTML output in the endpoint /product/. Exploitation of this vulnerability would allow an attacker to execute arbitrary JavaScript code.","publishedAt":"2026-05-11T14:27:08.899Z","updatedAt":"2026-05-11T17:33:57.767Z","severity":{"score":5.1,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","source":"INCIBE"},"assigner":"INCIBE","products":["e-commerce Cradle"],"affected":[{"vendor":"e-commerce","product":"Cradle","defaultStatus":"unaffected","versions":[{"version":"latest demo version","status":"affected","versionType":"custom"}]}],"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cradle-e-commerce"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:11:50.837Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/3xxx/CVE-2026-3320.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-3320","state":"PUBLISHED","datePublished":"2026-05-11T14:27:08.899Z","dateUpdated":"2026-05-11T17:33:57.767Z","assignerShortName":"INCIBE","assignerOrgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateReserved":"2026-02-27T10:16:12.434Z"},"containers":{"cna":{"title":"Multiple vulnerabilities in Cradle e-commerce","descriptions":[{"lang":"en","value":"Reflected Cross-Site Scripting (XSS) in the latest demo version of the Cradle eCommerce platform. User-controlled input is insecurely reflected in the HTML output in the endpoint /product/. Exploitation of this vulnerability would allow an attacker to execute arbitrary JavaScript code."}],"affected":[{"vendor":"e-commerce","product":"Cradle","defaultStatus":"unaffected","versions":[{"version":"latest demo version","status":"affected","versionType":"custom"}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cradle-e-commerce","tags":["patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"LOW","subConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","subIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"MEDIUM","baseScore":5.1,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","lang":"en","description":"CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')","type":"CWE"}]}],"providerMetadata":{"shortName":"INCIBE","orgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateUpdated":"2026-05-11T14:27:08.899Z"},"datePublic":"2026-05-11T14:22:00.000Z","solutions":[{"lang":"en","value":"The vulnerabilities have been fixed by the Cradle team in the latest version of Cradle eCommerce.\n\n\n\nThis issue does not affect Cradle CMS, as it does not include products or collections, nor does it have customer accounts for logging in.","supportingMedia":[{"type":"text/html","base64":false,"value":"The vulnerabilities have been fixed by the Cradle team in the latest version of Cradle eCommerce.\n<br>\n<br>This issue does not affect Cradle CMS, as it does not include products or collections, nor does it have customer accounts for logging in."}]}],"credits":[{"lang":"en","value":"Gonzalo Aguilar García (6h4ack)","type":"finder"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.2"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-05-11T17:33:51.194218Z","id":"CVE-2026-3320","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-05-11T17:33:57.767Z"}}]}}}