CVE-2026-7170
MediumCVSS 4.8Summary
Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the parameter 'vendor_store_name' in the endpoint '/administrator/index.php?pshop_mode=admin&page=store.store_add&option=com_virtuemart&vendor_id=[ID]'. Successful exploitation could allow an authenticated attacker to inject malicious code and execute it in users' browsers without their consent.
Risk Assessment
An attacker can hijack user sessions, steal data, or perform other malicious actions in the context of the victim's browser.
Recommendation
Update TPVEnlanube to the latest version that includes the fix, and validate and sanitize input data.
Other vulnerabilities in TPVEnlanube
See all- CVE-2026-7172Medium
Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the parameter 'Nombre Completo' in the endpoint '/administrator/index.php?option=com_virtuemart&page=admin.user_list'. Successful exploitation could allow an authenticated attacker to inject malicious code and execute it in users' browsers without their consent.
- CVE-2026-7171Medium
Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the parameter 'Apellido 1' in the endpoint '/administrator/index.php?page=admin.user_add&user_id=45&option=com_virtuemart'. Successful exploitation could allow an authenticated attacker to inject malicious code and execute it in users' browsers without their consent.
Original NVD description (English source)
Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoint and parameter: * CVE-2026-7170: parameter 'vendor_store_name' in the endpoint '/administrator/index.php?pshop_mode=admin&page=store.store_add&option=com_virtuemart&vendor_id=[ID]'. Successful exploitation of this vulnerability could allow an authenticated attacker to inject malicious code and execute it in users' browsers without their consent.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS