PT-2026-63432 · Froiden · Tabletrack

CVE-2026-64828 · Published 2026-07-22 · Updated 2026-07-22

Mitre

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Froiden TableTrack through 1.3.10 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary HTML and JavaScript through the order notes field without sanitization. Attackers can craft malicious payloads in customer order placement that execute in the admin's browser session when viewing order details, enabling session token theft or unauthorized administrative actions.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-64828

Affected Products

Tabletrack

References · 4

• 🔥 https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-64828 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-64828 · Security Note
• https://codecanyon.net/item/tabletrack-the-complete-saas-restaurant-management-solution/55116396 · Note
• https://vulncheck.com/advisories/froiden-tabletrack-stored-xss-via-order-notes-field · Note