CVE-2026-64828

MEDIUM 6.1

Froiden TableTrack 1.3.10 Stored XSS via Order Notes Field

CVSS Score

6.1

EPSS Score

0.0%

EPSS Percentile

0th

Froiden TableTrack through 1.3.10 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary HTML and JavaScript through the order notes field without sanitization. Attackers can craft malicious payloads in customer order placement that execute in the admin's browser session when viewing order details, enabling session token theft or unauthorized administrative actions.

CWE	CWE-79
Vendor	froiden
Product	tabletrack
Published	Jul 22, 2026

Stay Ahead of the Next One

Get instant alerts for froiden tabletrack

Be the first to know when new medium vulnerabilities affecting froiden tabletrack are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

Froiden / TableTrack

0 ≤ 1.3.10

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-64828 codecanyon.net: https://codecanyon.net/item/tabletrack-the-complete-saas-restaurant-management-solution/55116396 vulncheck.com: https://www.vulncheck.com/advisories/froiden-tabletrack-stored-xss-via-order-notes-field

Credits

Aaron Amran Bin Amiruddin