{"id":"CVE-2026-18205","kind":"vulnerability","aliases":["CVE-2026-18205"],"related":[],"title":"Ticimax E-Commerce Platform: reflected XSS lets attackers run scripts in shoppers' browsers","description":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ticimax Informatics Technologies Inc. Ticimax E-Commerce Platform allows Reflected XSS.\n\nThis issue affects Ticimax E-Commerce Platform: through 2026-09-02.","summary":"Ticimax E-Commerce Platform does not neutralize some input when generating web pages, enabling reflected cross-site scripting. An attacker who gets a user to open a crafted link can run script in that user's browser session on the store.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["e-commerce","hosted-platform","ticimax","vendor"],"not_affected_if":["unknown"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-20T12:17:30+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T04:04:12+00:00","updated_at":"2026-10-25T04:04:12+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-10-25T04:04:12Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"Ticimax E-Commerce Platform: reflected XSS lets attackers run scripts in shoppers' browsers","impact":"medium","summary":"Ticimax E-Commerce Platform does not neutralize some input when generating web pages, enabling reflected cross-site scripting. An attacker who gets a user to open a crafted link can run script in that user's browser session on the store.","category":"vendor","nicknames":[],"who_cares":["ticimax","e-commerce","hosted-platform"],"confidence":0.5,"needs_auth":"unknown","worst_case":"script runs in a shopper's browser on the store","analyst_note":"Check the vendor's advisory or Ticimax notice for affected versions, the vulnerable parameter and the fix; NVD at https://nvd.nist.gov/vuln/detail/CVE-2026-18205 gives no detail beyond the description.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Stores running the Ticimax E-Commerce Platform, through 2026-09-02 according to the NVD entry. The sources do not list affected versions or the vulnerable pages, so the team should confirm with the vendor whether their hosted store is affected. Stores on the hosted platform are patched or not by the vendor rather than by the store team.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000587,"input_tokens":3317,"output_tokens":510,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-02':109C '-09':108C '-18205':17A,20A '-2026':16A,19A '2026':107C 'affect':100C 'allow':95C 'attack':9A,50B 'browser':14A,67B 'commerc':4A,23B,32B,93C,104C 'craft':58B 'cross':46B,81C 'cross-sit':45B,80C 'cve':15A,18A 'e':3A,22B,31B,92C,103C 'e-commerc':2A,21B,30B,91C,102C 'enabl':43B 'generat':40B,79C 'get':52B 'host':25B 'hosted-platform':24B 'improp':72C 'inc':89C 'informat':87C 'input':38B,75C 'issu':99C 'let':8A 'link':59B 'neutral':36B,73C 'open':56B 'page':42B,78C 'platform':5A,26B,33B,94C,105C 'reflect':6A,44B,96C 'run':10A,61B 'script':11A,48B,62B,83C 'session':68B 'shopper':13A 'site':47B,82C 'store':71B 'technolog':88C 'ticimax':1A,27B,29B,86C,90C,101C 'user':54B,65B 'vendor':28B 'vulner':84C 'web':41B,77C 'xss':7A,97C","nicknames":[],"mitigations":[],"who_affected":"Stores running the Ticimax E-Commerce Platform, through 2026-09-02 according to the NVD entry. The sources do not list affected versions or the vulnerable pages, so the team should confirm with the vendor whether their hosted store is affected. Stores on the hosted platform are patched or not by the vendor rather than by the store team.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T12:17:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"iletisim@usom.gov.tr","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-18205","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18205","severity":null,"published_at":"2026-10-20T12:17:30+00:00","modified_at":"2026-10-20T19:30:59+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}