CVE-2026-3953

High

Published: 07/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

CVE-2026-3953 describes improper neutralization of input during web page generation, leading to Cross-Site Scripting (XSS) vulnerabilities in Proticaret E-Commerce software. The issue affects versions from 5.0.0 before 6.0.1767.1383.

Risk Assessment

An attacker could exploit this vulnerability to inject malicious JavaScript code, potentially leading to user data theft or session hijacking. Organizations using this software are at significant security risk.

Recommendation

It is recommended to update Proticaret E-Commerce to version 6.0.1767.1383 or later to mitigate this vulnerability. Additionally, conducting a security audit of web applications is advisable.

Other vulnerabilities in Proticaret E-Commerce

CVE-2014-9237High
SQL injection vulnerability in Proticaret E-Commerce 3.0 allows remote attackers to execute arbitrary SQL commands via a tem:Code element in a SOAP request.

Original NVD description (English source)

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Gosoft Software Industry and Trade Ltd. Co. Proticaret E-Commerce allows Cross-Site Scripting (XSS), Reflected XSS. This issue affects Proticaret E-Commerce: from v5.0.0 before V 6.0.1767.1383.