TI-2026-03417 Aliases CVE-2026-3953 GHSA-p86h-jj99-f63w

Reflected XSS in Gosoft Software's Proticaret E-Commerce

MEDIUM 40CWE-79Published 2026-05-07 · Updated 2026-05-07

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Gosoft Software Industry and Trade Ltd. Co. Proticaret E-Commerce allows Cross-Site Scripting (XSS), Reflected XSS. This issue affects Proticaret E-Commerce: from v5.0.0 before V 6.0.1767.1383.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00339 27th percentileScored 2026-11-07

Fix Fixed Proticaret E-Commerce (Gosoft Software Industry and Trade Ltd. Co.): V 6.0.1767.1383

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Gosoft Software Industry and Trade Ltd. Co.	Proticaret E-Commerce	v5.0.0 to before V 6.0.1767.1383	V 6.0.1767.1383	Patch available	CNA

Proticaret E-Commerce VendorGosoft Software Industry and Trade Ltd. Co. Affected v5.0.0 to before V 6.0.1767.1383 Fixed in V 6.0.1767.1383 Patch available CNA

Remediation

Fix · CNA Proticaret E-Commerce (Gosoft Software Industry and Trade Ltd. Co.) Fixed in V 6.0.1767.1383

Timeline

2026-10-02 Threatist record created from CVE-2026-3953
2026-10-03 Alias added: GHSA-p86h-jj99-f63w

References

Other 1

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0180

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences