Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-5798

Unsafe Object Reference (IDOR) vulnerability in Stel Order

Unsafe object reference (IDOR) in Stel Order v3.25.1 and earlier versions, specifically in the ‘/app/FrontController’ endpoint, through manipulation of the ‘employeeID’ parameter. An authenticated attacker could exploit this vulnerability to access information about any employee (first names, last names, roles, job titles, and vacation records, among others) by modifying that identifier in requests sent to the server.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Stel Order
Products
Stel Order
CVE-2026-5790

Stored Cross-Site Scripting (XSS) vulnerability in Stel Order

Stored Cross-Site Scripting (XSS) in Stel Order v3.25.1 and earlier, located at the ‘/app/FrontController’ endpoint via the ‘legalName’ and ‘employeeID’ parameters. The lack of proper input sanitization allows an attacker to inject malicious code that is persistently stored in the database. When other users or administrators access the affected sections, the code executes in their browsers, enabling the theft of session cookies and account hijacking.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Stel Order
Products
Stel Order