A vulnerability was found in code-projects Online Shopping System 1.0. (CVE-2026-82700)

CVE-2026-82700 describes a cross-site scripting vulnerability in an unspecified functionality within the /offersmail.php file of the Newsletter Subscription component in code-projects Online Shopping System 1.0. The vulnerability is caused by improper sanitization of the email parameter, enabling remote attackers to inject malicious scripts. The vulnerability has a CVSS 3.1 base score of 4.3 (low), with attack vector network, low attack complexity, no privileges required, user interaction required, and impacts integrity only. Exploit code has been publicly disclosed, but no known active exploitation in the wild is reported. No vendor patch or official fix information is provided.

The vulnerability allows remote attackers to perform cross-site scripting attacks by manipulating the email argument. This can lead to limited integrity impacts such as script injection in the context of users interacting with the affected functionality. There is no direct confidentiality or availability impact reported. Exploitation requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious when interacting with the affected functionality. No official fix or workaround has been published.