CVE-2026-64828 is a stored cross-site scripting vulnerability in Froiden TableTrack through version 1.3.10. The vulnerability arises from improper neutralization of input in the order notes field, which does not sanitize attacker-supplied HTML and JavaScript. An unauthenticated attacker can inject malicious scripts during customer order placement. These scripts execute in the administrator's browser session when viewing the order details, potentially enabling session token theft or unauthorized administrative actions. The CVSS 4.0 base score is 5.3, indicating medium severity. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of an administrator's browser session. This can lead to theft of session tokens or unauthorized administrative actions, compromising the integrity and confidentiality of the administrative interface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the administrative interface and consider implementing web application firewall (WAF) rules to detect and block malicious input in the order notes field.