EUVD-2026-59812
GHSA-x9xw-hf2x-647j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Low privileges and required user interaction limit exposure; no scope change as subsequent-system impact is absent; confidentiality rated Low because XSS can exfiltrate session tokens.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A security flaw has been discovered in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /checkout.php. Performing a manipulation of the argument amount_1 results in cross site scripting. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.
AnalysisAI
Cross-site scripting in code-projects Online Shopping System 1.0 allows remote low-privileged attackers to inject arbitrary JavaScript into victim browsers via the unsanitized amount_1 parameter in /checkout.php, enabling session hijacking, credential theft, or UI manipulation against users who interact with the crafted response. The affected product is a PHP-based e-commerce application distributed by code-projects.org, with the vulnerability tracked exclusively through VulDB. A public proof-of-concept exploit has been released on GitHub, elevating the practical risk beyond the moderate CVSS 4.0 score of 5.1 suggests in isolation.
Technical ContextAI
The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), a failure to encode or sanitize user-controlled input before it is reflected into an HTML response. The affected software is a PHP web application identified by CPE cpe:2.3:a:code-projects:online_shopping_system:*:*:*:*:*:*:*:*, sold/distributed via code-projects.org as a ready-to-deploy shopping platform. The specific injection point is the amount_1 parameter processed by /checkout.php, which appears to handle order or cart amount values without applying adequate output encoding. Because the parameter name suggests a numeric financial field, it is likely that input validation expects digits but does not apply HTML-context output encoding before rendering the value back into the page, a common PHP anti-pattern in older or demo-quality codebases.
RemediationAI
No vendor-released patch has been identified at time of analysis. The primary fix requires a code-level change to /checkout.php: apply htmlspecialchars() (or equivalent output encoding) to the amount_1 parameter - and all user-supplied input - before rendering values into HTML responses. Additionally, server-side validation should reject non-numeric values for amount fields at the input layer. As an immediate compensating control, deploying a web application firewall rule to block common XSS payloads (e.g., <script>, javascript:, event handler attributes) in the amount_1 parameter can reduce exposure, but WAF bypass is possible and this is not a permanent mitigation. Restricting checkout page access to authenticated sessions (if not already enforced) does not eliminate the vulnerability but reduces the pool of potential attackers consistent with the PR:L CVSS signal. Monitor VulDB (https://vuldb.com/vuln/390172) for any upstream patch release from the vendor.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today