CVE-2026-4378

Received Received - Intake

Stored XSS in Akilli Ticaret E-Commerce Pack

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: Computer Emergency Response Team of the Republic of Turkey

Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Akilli Ticaret Software Technologies Ltd. E-Commerce Pack allows Stored XSS. This issue affects E-Commerce Pack: from 4.5.001 through 28082026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-4378

EUVD

EUVD-2026-67740

Affected Vendors & Products

Vendor	Product	Version / Range
akilli_ticaret_software_technologies_ltd	e-commerce_pack	From 4.5.001 (inc) to 28082026 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Akilli Ticaret Software Technologies Ltd. E-Commerce Pack. It allows attackers to inject malicious scripts into web pages that are stored on the server and later served to other users. The flaw exists due to improper neutralization of user input during web page generation.

Impact Analysis

An attacker could exploit this to steal user sessions, deface web pages, or perform actions on behalf of users. Users visiting affected pages may have their data compromised or be redirected to malicious sites without their knowledge.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face fines or legal consequences if exploited.

Mitigation Strategies

Update E-Commerce Pack to a version beyond 28082026 to address the stored XSS vulnerability. If no update is available, consider disabling the affected component or implementing input validation and output encoding measures.

Hi! I’m here to help you understand CVE-2026-4378. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70