CVE-2026-5836

LowCVSS 2.4

Published: 09/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

The code-projects Online Shoe Store 1.0 is vulnerable to XSS in /admin/admin_product.php via the product_name argument. The attack is remote and the exploit is public.

Risk Assessment

An attacker can inject a script that executes in the admin's browser, leading to session theft or product modification.

Recommendation

Update the application or apply input validation and sanitization in admin_product.php.

Original NVD description (English source)

A vulnerability has been found in code-projects Online Shoe Store 1.0. Affected by this issue is some unknown functionality of the file /admin/admin_product.php. The manipulation of the argument product_name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.