CVE-2026-5836
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The code-projects Online Shoe Store 1.0 is vulnerable to XSS in /admin/admin_product.php via the product_name argument. The attack is remote and the exploit is public.
Risk Assessment
An attacker can inject a script that executes in the admin's browser, leading to session theft or product modification.
Recommendation
Update the application or apply input validation and sanitization in admin_product.php.
Other vulnerabilities in code-projects Online Shoe Store
See all- CVE-2026-5835Low
The code-projects Online Shoe Store 1.0 is vulnerable to XSS in /admin/admin_football.php via the product_name argument. The attack is remote and the exploit is public.
- CVE-2026-5834Low
The code-projects Online Shoe Store 1.0 is vulnerable to XSS in /admin/admin_running.php via the product_name argument. The attack is remote and the exploit is public.
Original NVD description (English source)
A vulnerability has been found in code-projects Online Shoe Store 1.0. Affected by this issue is some unknown functionality of the file /admin/admin_product.php. The manipulation of the argument product_name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS