Skip to content

Vendor

Stel Order vulnerabilities

2 published CVES affecting Stel Order, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
1
Medium
1
Low
0
Unscored
0
CISA KEV
0
Atom feed of Stel Order alerts

Products

Latest Stel Order CVEs

Newest publication first

  1. CVE-2026-5790 Stored Cross-Site Scripting (XSS) vulnerability in Stel Order

    Published
    MediumCVSS 5.1 EPSS 0.26%

    Stored Cross-Site Scripting (XSS) in Stel Order v3.25.1 and earlier, located at the ‘/app/FrontController’ endpoint via the ‘legalName’ and ‘employeeID’ parameters. The lack of proper input sanitization allows an attacker to inject malicious code that is persistently stored in th...

  2. CVE-2026-5798 Unsafe Object Reference (IDOR) vulnerability in Stel Order

    Published
    HighCVSS 7.1 EPSS 0.21%

    Unsafe object reference (IDOR) in Stel Order v3.25.1 and earlier versions, specifically in the ‘/app/FrontController’ endpoint, through manipulation of the ‘employeeID’ parameter. An authenticated attacker could exploit this vulnerability to access information about any employee...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.