CVE-2026-5790

🗓️ 14 May 2026 12:30:32Reported by INCIBEType

cve🔗 web.nvd.nist.gov👁 11 Views🌐 WEB

Stored cross site scripting in Stel Order before 3.25.2 via /app/FrontController parameters legalName and employeeID.

Reporter	Title	Published	Views	Family All 8
ATTACKERKB	CVE-2026-5790	14 May 202612:30	–	attackerkb
CNNVD	STEL Order 跨站脚本漏洞	14 May 202600:00	–	cnnvd
Cvelist	CVE-2026-5790 Stored Cross-Site Scripting (XSS) vulnerability in Stel Order	14 May 202612:30	–	cvelist
EUVD	EUVD-2026-30268	14 May 202612:30	–	euvd
NVD	CVE-2026-5790	14 May 202613:16	–	nvd
Positive Technologies	PT-2026-40912	14 May 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-5790	5 Jun 202619:35	–	redhatcve
Vulnrichment	CVE-2026-5790 Stored Cross-Site Scripting (XSS) vulnerability in Stel Order	14 May 202612:30	–	vulnrichment

Vulners

CNA

Node

stel_order stel_orderRange≤3.25.1

[
  {
    "vendor": "Stel Order",
    "product": "Stel Order",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThanOrEqual": "3.25.1",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]

Source	Link
incibe	www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-stel-order

Parameter	Position	Path	Description	CWE
legalName	request body	/app/FrontController	Stored Cross-Site Scripting (XSS) in Stel Order v3.25.1 and earlier, located at the '/app/FrontController' endpoint via the 'legalName' and 'employeeID' parameters. The lack of proper input sanitization allows an attacker to inject malicous code that is persistently stored in the database. When other users or administrators access the affected sections, the code executes in their browsers, enabling the theft of session cookies and account hijacking.	CWE-79
employeeID	request body	/app/FrontController	Stored Cross-Site Scripting (XSS) in Stel Order v3.25.1 and earlier, located at the '/app/FrontController' endpoint via the 'legalName' and 'employeeID' parameters. The lack of proper input sanitization allows an attacker to inject malicous code that is persistently stored in the database. When other users or administrators access the affected sections, the code executes in their browsers, enabling the theft of session cookies and account hijacking.	CWE-79

17 Jun 2026 10:59Current

5.8Medium risk

Vulners AI Score5.8

CVSS 45.1

EPSS0.00258

SSVC

CWE-79