Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Stored Cross-Site Scripting (XSS) in Stel Order v3.25.1 and earlier, located at the ‘/app/FrontController’ endpoint via the ‘legalName’ and ‘employeeID’ parameters. The lack of proper input sanitization allows an attacker to inject malicious code that is persistently stored in the database. When other users or administrators access the affected sections, the code executes in their browsers, enabling the theft of session cookies and account hijacking.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
⚠️#INCIBEaviso | Múltiples vulnerabilidades en #StelOrder #CVE CVE-2026-5798 y CVE-2026-5790 https://www.incibe.es/incibe-cert/alerta-temprana/avisos/multiples-vulnerabilidades-en-stel-order #AvisosDeSeguridad #TI #CNA
Post summary
The post announces several CVEs affecting StelOrder and links to an official advisory, but provides no further exploitation details, PoC, patches, or technical specifics.