PatchSiren

Froiden CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM Froiden CVE published 2026-07-22

CVE-2026-64828

CVE-2026-64828 is a stored cross-site scripting vulnerability in Froiden TableTrack through 1.3.10. The vulnerability allows unauthenticated attackers to inject arbitrary HTML and JavaScript through the order notes field without sanitization. Attackers can craft malicious payloads in customer order placement that execute in the admin's browser session when viewing order details, enabling session token the [truncated]