Stored XSS in TPVEnlanube Vendor Store Name Parameter

Executive Summary

CVE-2026-7170 is a stored Cross-Site Scripting (XSS) vulnerability in TPVEnlanube. It affects the 'vendor_store_name' parameter in a specific admin endpoint. An authenticated attacker can inject malicious code that executes in users' browsers without their consent.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect the TPVEnlanube application for the affected endpoint '/administrator/index.php?pshop_mode=admin&page=store.store_add&option=com_virtuemart&vendor_id=[ID]' and check if the 'vendor_store_name' parameter is properly sanitizing user input. Look for stored XSS indicators like script tags or event handlers in stored data.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to inject malicious scripts into web pages viewed by other users. This could lead to theft of session cookies, account takeover, or defacement of the application. Users may unknowingly execute harmful code when accessing affected pages.

Useful 0 Not Useful 0

Compliance Impact

Stored XSS can lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, unauthorized disclosure, or loss of user trust, potentially leading to regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately apply input validation and output encoding to the 'vendor_store_name' parameter. Ensure all user-supplied data is sanitized before storage and rendering. Monitor for any suspicious activity or unauthorized changes in the application.

Useful 0 Not Useful 0