This vulnerability affects code-projects Online Shopping System version 1.0. It is a cross-site scripting (XSS) flaw in an unspecified function within offersmail.php. By manipulating the email parameter, an attacker can inject malicious scripts that execute in the context of the victim's browser. The attack vector is network-based with no privileges required and no user interaction needed to initiate the attack, but user interaction is required to trigger the payload. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. Public exploit code is available, but no active exploitation has been reported. No vendor advisory or patch information is currently available.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of a victim's browser, potentially leading to session hijacking, defacement, or redirection to malicious sites. The vulnerability is remotely exploitable and requires user interaction to trigger. There is no indication of privilege escalation or impact on confidentiality, integrity, or availability beyond the XSS context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with email links or inputs related to the offersmail.php functionality. Implementing web application firewall (WAF) rules to detect and block suspicious input patterns may help mitigate exploitation risk.