This vulnerability involves a cross-site scripting issue in the Online Shoe Store 1.0 product by code-projects. Specifically, the product_name parameter in the /admin/admin_football.php script is vulnerable to input manipulation that results in XSS. The vulnerability allows remote attackers with high privileges to execute scripts in the context of the affected application, potentially impacting users who interact with the crafted input. The CVSS 4.0 base score is 4.8, indicating medium severity. No patch or official remediation has been published as of the data provided.

Successful exploitation of this vulnerability could allow an attacker with high privileges to execute arbitrary scripts in the context of the application, potentially leading to session hijacking, defacement, or other client-side impacts. The vulnerability requires user interaction and does not involve privilege escalation or confidentiality impact. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should restrict access to the affected admin functionality and validate or sanitize inputs to the product_name parameter to mitigate potential exploitation.