CVE-2026-5834

CVE-2026-5834 is a cross-site scripting (XS) vulnerability in code-projects Online Shoe Store version 1.0, specifically affecting the product_name parameter in the /admin/admin_running.php file. The vulnerability allows an attacker to inject malicious scripts through manipulation of user-supplied input in an administrative interface. The vulnerability carries a CVSS v3.1 score of 2.4 (LOW) with a network attack vector and low attack complexity, indicating it is remotely accessible but requires high-level privileges and user interaction to exploit. The attack has no impact on confidentiality or availability, with only limited integrity implications, making it a low-severity issue overall. Public exploit code is currently available for this vulnerability, though active exploitation appears minimal given its low EPSS score of 0.00032 and absence from the Known Exploited Vulnerabilities catalog. The vulnerability has not gained significant community attention, as evidenced by its low FAUCET risk score of 33.0/100 and inactive status on threat intelligence hot lists, suggesting limited real-world threat to most organizations.