Stored Cross-Site Scripting in TPVEnlanube Affects E-commerce Platforms

CVE-2026-7172

What is CVE-2026-7172?

This vulnerability enables an authenticated attacker to exploit a stored cross-site scripting weakness in TPVEnlanube, specifically through the 'Nombre Completo' parameter found in the '/administrator/index.php?option=com_virtuemart&page=admin.user_list' endpoint. By injecting malicious scripts, the attacker can execute harmful code within the browsers of users who access the compromised area, leading to potential data theft and unauthorized access to sensitive information.

References