CVE-2026-8117

Vulnerability

CVE-2026-8117 describes a reflected cross-site scripting (XSS) vulnerability in SourceCodester Pizzafy Ecommerce System 1.0. The issue arises in the file /admin/index.php, where the page parameter is not properly sanitized before being processed. This allows an attacker to inject arbitrary HTML and JavaScript code into the response, which is then executed in the victim's browser [1].

Exploitation

The attack can be launched remotely and does not require authentication, making it accessible to any attacker who can craft a malicious URL. The exploit has been publicly disclosed, increasing the risk of widespread use [1]. The vulnerability is classified as medium severity with a CVSS v3 score of 4.3.

Impact

Successful exploitation enables an attacker to execute arbitrary scripts in the context of the victim's session. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites. Because the vulnerability is in the admin panel, it may expose administrative functions to abuse [1].

Mitigation

As of the publication date, the vendor has not released a patch or official advisory via the SourceCodester website [2]. Users are advised to apply input validation and output encoding to the page parameter or restrict access to the admin panel until a fix is available.