CVE-2026-5647

Vulnerability

An unauthenticated reflected cross-site scripting (XSS) vulnerability exists in the code-projects Online Shoe Store version 1.0. The issue affects the /admin/admin_feature.php file, specifically the product_name parameter on the Add Product Page. The application outputs user-supplied input directly into the web page without proper encoding or filtering, enabling an attacker to inject arbitrary HTML and JavaScript code. [1]

Exploitation

No authentication or prior authorization is required to reach the vulnerable endpoint. An attacker can craft a malicious URL containing a script payload (e.g., `) in the product_name` parameter. When an administrator visits the crafted link, the script executes in the context of the victim's session. [1]

Impact

Successful exploitation allows an attacker to execute arbitrary script code in the victim's browser. This can lead to theft of cookies and session tokens, unauthorized actions performed on behalf of the victim, web page defacement, redirection to malicious sites, and potential control over the victim's browser, compromising user privacy and system security. [1]

Mitigation

As of the publication date (April 2026), the vendor has not released a patched version. The recommended fix is to properly encode user input when outputting it to web pages, ensuring all special characters are escaped. [1]