A DOM-based cross-site scripting (XSS) vulnerability exists in electic-shop version 1.0. The vulnerability arises because client-side JavaScript processes attacker-controlled input and inserts it into the DOM using unsafe methods without proper sanitization or encoding. This allows an attacker to craft a malicious URL that executes arbitrary JavaScript in the victim's browser within the electic-shop origin.