CVE-2026-64828 is a stored cross-site scripting vulnerability in Froiden TableTrack through version 1.3.10. The vulnerability arises from improper neutralization of input in the order notes field, which does not sanitize user-supplied data. Unauthenticated attackers can inject malicious HTML or JavaScript payloads during customer order placement. When an administrator views the order details, the injected script executes in their browser context, potentially allowing session hijacking or unauthorized administrative actions. The vulnerability has a CVSS 4.0 score of 5.3 (medium severity). No vendor advisory or patch is currently available, and the product is not a cloud service.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the administrator's browser session, leading to session token theft or unauthorized administrative actions. This compromises the confidentiality and integrity of the administrative interface and potentially the entire application environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the administrative interface to trusted users only and consider additional web application firewall (WAF) rules to detect and block malicious input in the order notes field. Avoid using the affected functionality if possible until remediation is provided.