Stel Order vulnerabilities
Published CVEs affecting Stel Order products: 2 record(s), with severity, exploitation and fixes.
CVE-2026-5798
High · 7.1
CWE-639 May 14, 2026
Unsafe Object Reference (IDOR) vulnerability in Stel Order
Unsafe object reference (IDOR) in Stel Order v3.25.1 and earlier versions, specifically in the ‘/app/FrontController’ endpoint, through manipulation of the ‘employeeID’ parameter. An authenticated attacker could exploit this vulnerability to access information about any employee (first names, last names, roles, job titles, and vacation records, among others) by modifying that identifier in requests sent to the server.
CVE-2026-5790
Medium · 5.1
CWE-79 May 14, 2026
Stored Cross-Site Scripting (XSS) vulnerability in Stel Order
Stored Cross-Site Scripting (XSS) in Stel Order v3.25.1 and earlier, located at the ‘/app/FrontController’ endpoint via the ‘legalName’ and ‘employeeID’ parameters. The lack of proper input sanitization allows an attacker to inject malicious code that is persistently stored in the database. When other users or administrators access the affected sections, the code executes in their browsers, enabling the theft of session cookies and account hijacking.