Description
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in IdeaSoft Software Industry and Trade Inc. Smart E-Commerce allows Reflected XSS.

This issue affects Smart E-Commerce: before 8.4.2.0.
Published: 2026-09-11
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Reflected Cross‑Site Scripting
Action: Patch
AI Analysis

Impact

The vulnerability is an improper neutralization of user‑supplied input during web page generation, allowing a reflected Cross‑Site Scripting flaw. This flaw enables an attacker to inject malicious scripts that are executed in the victim’s browser when the page is viewed.

Affected Systems

The flaw exists in IdeaSoft Software Industry and Trade Inc.'s Smart E‑Commerce product in any release before version 8.4.2.0. No other versions or products are listed as affected in the CVE data.

Risk and Exploitability

The CVSS v3.1 score of 6.1 indicates moderate severity. The EPSS score below 1 % indicates a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, and no public exploits are known. The likely attack vector would involve enticing a user to a crafted URL or form that contains unsanitized input which the server echoes back. Based on the description, it is inferred that an attacker would need to lure a victim to view a page containing malicious scripts to trigger the flaw.

Generated by OpenCVE AI on September 26, 2026 at 07:04 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade IdeaSoft Smart E‑Commerce to version 8.4.2.0 or later to remove the reflected XSS flaw.
  • Ensure all user-controllable data is properly encoded or sanitized before embedding it into HTML output, following best practices for CWE‑79 mitigation.
  • Deploy a strict Content Security Policy that blocks inline scripts, restricts script sources to trusted domains, and includes nonces or hashes as appropriate.

Generated by OpenCVE AI on September 26, 2026 at 07:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 25 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Description Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in IdeaSoft Software Industry and Trade Inc. Smart E-Commerce allows Reflected XSS. This issue affects Smart E-Commerce: through 11092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in IdeaSoft Software Industry and Trade Inc. Smart E-Commerce allows Reflected XSS. This issue affects Smart E-Commerce: before 8.4.2.0.

Sun, 13 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Ideasoft Software Industry And Trade Inc.
Ideasoft Software Industry And Trade Inc. smart E-commerce
Vendors & Products Ideasoft Software Industry And Trade Inc.
Ideasoft Software Industry And Trade Inc. smart E-commerce

Fri, 11 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Description Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in IdeaSoft Software Industry and Trade Inc. Smart E-Commerce allows Reflected XSS. This issue affects Smart E-Commerce: through 11092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Title Reflected XSS in IdeaSoft's Smart E-Commerce
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

Ideasoft Software Industry And Trade Inc. Smart E-commerce
cve-icon MITRE

Status: PUBLISHED

Assigner: TR-CERT

Published:

Updated: 2026-09-25T14:06:08.440Z

Reserved: 2026-04-28T11:20:36.742Z

Link: CVE-2026-7298

cve-icon Vulnrichment

Updated: 2026-09-11T19:24:11.180Z

cve-icon NVD

Status : Deferred

Published: 2026-09-11T18:16:58.340

Modified: 2026-09-25T15:17:55.800

Link: CVE-2026-7298

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T07:15:06Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')