CVE-2026-3318— Cradle eCommerce 输入验证错误漏洞

Multiple vulnerabilities in Cradle e-commerce

Open redirection vulnerability in the latest demo version of the Cradle eCommerce platform. The vulnerability occurs in the login form endpoint, where the ‘returnUrl’ parameter allows redirection because the web application accepts a URL as a parameter without properly validating it. As a result, it is possible to redirect users from the legitimate website to external pages. An attacker could exploit this vulnerability to deceive users and redirect them from a trusted URL to a malicious one without their knowledge.

N/A

指向未可信站点的URL重定向(开放重定向)

Cradle eCommerce 输入验证错误漏洞

Cradle eCommerce是Cradle公司的一个集内容管理与在线商城功能于一体的电子商务平台。 Cradle eCommerce存在输入验证错误漏洞，该漏洞源于登录表单端点中的returnUrl参数未正确验证，可能导致开放重定向，攻击者可将用户从合法网站重定向到恶意页面。

N/A

N/A