This vulnerability affects SourceCodester SUP Online Shopping 1.0 and involves a cross-site scripting flaw in the /admin/productedit.php file. Specifically, the productName parameter can be manipulated remotely to execute arbitrary scripts in the context of the affected application. The CVSS 4.8 score reflects a medium severity with network attack vector, low attack complexity, and no privileges required but user interaction needed. No official fix or patch has been disclosed at this time.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side attacks. However, the impact is limited by the medium severity score and the requirement for user interaction. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or output encoding on the productName parameter to mitigate XSS risks. Monitoring for updates from SourceCodester is recommended.