CVE-2026-64828 - Froiden TableTrack 1.3.10 Stored XSS via Order Notes Field

A GitHub repository version of this disclosure can be read here: CVE-2026-64828.

Description

Froiden TableTrack through 1.3.10 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary HTML and JavaScript through the order notes field without sanitization. Attackers can craft malicious payloads in customer order placement that execute in the admin's browser session when viewing order details, enabling session token theft or unauthorized administrative actions.

Proof-of-Concept

1. Access the customer-facing portal and select any order type to proceed (the selected order type does not impact the vulnerability).

2. Add any item to the cart. In the Order Notes field, enter the following XSS payload and click Place Order:

<u>test</u><script>alert(document.domain)</script>

3. Log in to the application as a Restaurant Admin. A notification indicating that a new customer order has been placed will appear.

4. Navigate to the newly created order. Upon page load, the injected JavaScript payload immediately executes in the context of the admin's session, confirming Stored XSS.

5. Dismissing the alert dialog reveals the underlined "test" text rendered in the order details, highlighting the un-sanitized output sink.

Timeline

• 21 July 2026: This vulnerability in TableTrack v1.3.10 was initially discovered using their live demo instance. I submitted a complete report to VulnCheck and requested direct public disclosure after being unable to find a security contact email for the vendor. Following an initial triage, VulnCheck confirmed they were also unable to locate a security reporting mechanism for Froiden. Consequently, they supported the decision to proceed with public disclosure and reserved a CVE ID for this vulnerability.
• 22 July 2026: I published a public disclosure in my CVE-Disclosures repository on GitHub. VulnCheck then officially published CVE-2026-64828 later that day.
• 23 July 2026: Published this blog post.