Cradle eCommerce vulnerabilities

3 known CVE vulnerabilities in Cradle eCommerce, translated and rated.

CVE-2026-3320Medium
The latest demo version of the Cradle eCommerce platform contains a reflected Cross-Site Scripting (XSS) vulnerability in the /product/ endpoint. User-controlled input is insecurely reflected in the HTML output, allowing an attacker to execute arbitrary JavaScript code.
CVE-2026-3319Medium
The latest demo version of the Cradle eCommerce platform contains a reflected Cross-Site Scripting (XSS) vulnerability in the /collection/ endpoint. User-controlled input is insecurely reflected in the HTML output, allowing an attacker to execute arbitrary JavaScript code.
CVE-2026-3318Medium
The latest demo version of the Cradle eCommerce platform contains an open redirection vulnerability in the login form endpoint. The 'returnUrl' parameter allows redirection because the application accepts a URL as a parameter without proper validation, enabling redirection of users from the legitimate website to external pages.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS