This vulnerability involves a cross-site scripting flaw in the Online Shoe Store 1.0 application by code-projects. Specifically, the product_name parameter in the /admin/admin_running.php file can be manipulated remotely to inject malicious scripts. The vulnerability allows attackers to perform XSS attacks, potentially impacting users who interact with the affected functionality. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, partial user interaction, and low impact on integrity. No official fix or patch has been disclosed yet.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side attacks. However, the impact is rated medium due to limited integrity impact and the requirement for some user interaction. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to apply input validation and output encoding on the product_name parameter to mitigate XSS risks. Monitor vendor channels for updates regarding patches or official mitigations.