CVE-2026-5800: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in Dayneks Software Industry and Trade Inc. E-Commerce Platform

This vulnerability involves improper neutralization of input in the Dayneks E-Commerce Platform, leading to reflected cross-site scripting (CWE-79). An attacker can exploit this flaw by injecting malicious scripts into web pages generated by the platform, potentially impacting confidentiality and integrity of user data. The CVSS v3.1 base score is 6.1, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and a scope change. The vendor has not provided a response or patch, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, leading to partial confidentiality and integrity impact. There is no impact on availability. This could result in theft of user credentials, session hijacking, or other malicious actions within the user's browser session.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should apply standard XSS mitigations such as input validation and output encoding where possible. Monitor for vendor updates regarding official fixes.