This vulnerability affects SourceCodester Pizzafy Ecommerce System 1.0 in the save_user function located at /admin/ajax.php?action=save_user. An attacker can manipulate the Name parameter to inject malicious scripts, resulting in a cross-site scripting vulnerability. The attack vector is network-based with low attack complexity but requires privileges and user interaction. The CVSS 4.0 base score is 4.8, indicating medium severity. No official fix or patch has been published, and the product is not a cloud service, so remediation depends on vendor updates or user-applied mitigations.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side impacts. The vulnerability requires the attacker to have high privileges and user interaction, which limits the scope of impact. There is no indication of data confidentiality or integrity compromise beyond the XSS impact. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should monitor for vendor updates. As a temporary measure, applying input validation or output encoding on the Name parameter in the save_user function may reduce risk. Avoid granting unnecessary high privileges to users to limit exploitation potential.