This vulnerability affects code-projects Online Shoe Store 1.0 and involves a cross-site scripting flaw in the /admin/admin_running.php file. Specifically, the product_name parameter is vulnerable to manipulation that results in XSS, allowing an attacker to inject malicious scripts. The vulnerability is remotely exploitable and requires user interaction. The CVSS 4.0 base score is 4.8, indicating medium severity. No official patch or vendor remediation information is currently available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected application for users who interact with the manipulated product_name parameter. This could lead to session hijacking, defacement, or other client-side impacts. However, the vulnerability requires user interaction and privileges to access the admin_running.php page, limiting the scope of impact. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected admin interface and validating or sanitizing input parameters such as product_name to mitigate potential exploitation.