A reflected Cross-Site Scripting (XSS) vulnerability exists in the latest demo version of the Cradle eCommerce platform at the /collection/ endpoint. This flaw allows user-controlled input to be insecurely reflected in HTML output, enabling an attacker to execute arbitrary JavaScript code in the context of the victim's browser.