This vulnerability in SourceCodester Pizzafy Ecommerce System 1.0 involves improper input validation of the 'page' parameter in /admin/index.php, leading to cross-site scripting (XSS). An attacker can remotely inject malicious scripts that may execute in the context of the victim's browser. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low impact on integrity and availability. No official fix or patch has been documented, and the vulnerability is publicly disclosed.

Successful exploitation allows remote attackers to perform cross-site scripting attacks, potentially leading to session hijacking, defacement, or other malicious actions executed in the context of an authenticated administrator's browser. The impact is rated medium due to the need for user interaction and limited integrity and availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider applying input validation or filtering on the 'page' parameter in /admin/index.php to mitigate XSS risks. Monitoring for suspicious activity related to this parameter is advisable. Avoid clicking on suspicious links that may exploit this vulnerability.