CVE-2026-5647

CVE-2026-5647 is a cross-site scripting (XSS) vulnerability affecting the Add Product Page component in code-projects Online Shoe Store version 1.0, specifically within the /admin/admin_admin_feature.php file where the product_name parameter is improperly sanitized. The vulnerability allows attackers to inject malicious scripts through the product name field, potentially compromising administrative functionality and user sessions. The vulnerability presents a LOW severity risk with a CVSS v3.1 score of 2.4. It requires network access and high-level administrative privileges to exploit, making it primarily a concern for insider threats or compromised administrative accounts. The attack necessitates user interaction and carries limited impact potential, resulting in minor integrity compromise without affecting confidentiality or system availability. Public exploit code is currently available, which increases the operational risk despite the low CVSS score. However, the vulnerability is not tracked in the Known Exploited Vulnerabilities (KEV) catalog and shows minimal community attention with an EPSS score of 0.00032, indicating very low real-world exploitation probability. Organizations running this legacy e-commerce platform should prioritize patching based on their administrative access controls and exposure profile rather than the vulnerability's base severity metrics.