CVE-2026-5835

CVE-2026-5835 is a cross-site scripting (XSS) vulnerability affecting code-projects Online Shoe Store version 1.0, specifically in the /admin/admin_football.php file where the product_name argument fails to properly sanitize user input. The flaw allows an attacker to inject malicious scripts that execute in the context of an administrator's browser session. The vulnerability carries a CVSS score of 2.4 (LOW) with a network-based attack vector and low complexity, but requires high-level privileges and user interaction to exploit. The attack surface is limited to reflected XSS with no direct confidentiality or availability impact, though it could enable unauthorized modifications or session hijacking if successfully weaponized. Exploitation of this vulnerability remains minimal based on available indicators. While proof-of-concept code has been published, the vulnerability shows no evidence of active exploitation in the wild, receives low community attention based on its EPSS score of 0.0003, and has not been added to the CISA Known Exploited Vulnerabilities catalog. Organizations using this software should prioritize patches but face relatively low imminent risk.