Stel Order
Approved changes feed: RSS · Atom
cpe:2.3:a:stel_order:stel_order:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Stel Order (b3fbd820-e27d-5e27-8649-3a0655c8167f) |
|---|---|
| Product | Stel Order (aaae1842-7f45-50b3-be92-718cc985e792) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-5798 |
vulnerable | 2026-06-08 08:07:04.111867 |
Unsafe Object Reference (IDOR) vulnerability in Stel Order
Unsafe object reference (IDOR) in Stel Order v3.25.1 and earlier versions, specifically in the ‘/app/FrontController’ endpoint, through manipulation of the ‘employeeID’ parameter. An authenticated attacker could exploit this vulnerability to access information about any employee (first names, last names, roles, job titles, and vacation records, among others) by modifying that identifier in requests sent to the server.
Published: 2026-05-14T12:26:09.501Z
Updated: 2026-05-14T13:48:15.193Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-5790 |
vulnerable | 2026-06-08 08:07:04.103711 |
Stored Cross-Site Scripting (XSS) vulnerability in Stel Order
Stored Cross-Site Scripting (XSS) in Stel Order v3.25.1 and earlier, located at the ‘/app/FrontController’ endpoint via the ‘legalName’ and ‘employeeID’ parameters. The lack of proper input sanitization allows an attacker to inject malicious code that is persistently stored in the database. When other users or administrators access the affected sections, the code executes in their browsers, enabling the theft of session cookies and account hijacking.
Published: 2026-05-14T12:30:32.023Z
Updated: 2026-05-14T13:47:51.077Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.