CVE-2026-79793: Cross Site Scripting in code-projects Online Shopping System

This vulnerability affects code-projects Online Shopping System version 1.0. It involves improper handling of the 'Success' argument in the /admin/sumit_form.php file, allowing an attacker to inject malicious scripts via cross-site scripting (XSS). The attack vector is network-based with low attack complexity and no privileges required, but user interaction is necessary. No official patch or remediation guidance is currently available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or redirection of users to malicious sites. However, the impact is limited by the requirement for user interaction and the lack of elevated privileges needed to exploit it.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation and output encoding on the 'Success' parameter in /admin/sumit_form.php to mitigate the risk. Monitoring and restricting access to the affected admin interface may also reduce exposure.