SourceCodester Pizzafy Ecommerce System 1.0 contains a cross-site scripting (XSS) vulnerability in the /admin/index.php file due to improper handling of the 'page' argument. This vulnerability can be exploited remotely and requires user interaction. Public exploit code has been disclosed. The CVSS score is 4.3, indicating medium severity.