Description
A security flaw has been discovered in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /checkout.php. Performing a manipulation of the argument amount_1 results in cross site scripting. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.
Published: 2026-08-16
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability lies in the checkout.php file of Online Shopping System 1.0. By manipulating the amount_1 parameter, an attacker can inject malicious scripts that are executed in the victim’s browser. This leads to the ability to run arbitrary client‑side code, potentially hijacking user sessions, defacing pages, or phishing for credentials. The flaw is a classic reflected XSS flaw classified as CWE‑79, and it also involves an unsupported code execution path signified by CWE‑94.

Affected Systems

The affected vendor is code‑projects with the product Online Shopping System, version 1.0. No other versions or products are currently listed as affected.

Risk and Exploitability

The CVSS score of 5.1 indicates a moderate severity. The EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited proof‑of‑concepts in production. The attack can be initiated remotely via HTTP requests supplied by an attacker, and the exploit code has already been publicly released.

Generated by OpenCVE AI on August 16, 2026 at 01:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑supplied patch or upgrade to the latest version of Online Shopping System.
  • Validate and sanitize the amount_1 input on the server side, ensuring it is correctly encoded before inclusion in any output.
  • Enforce a strict Content Security Policy to limit executable scripts and reduce the impact scope of any remaining XSS vectors.

Generated by OpenCVE AI on August 16, 2026 at 01:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 18 Aug 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 16 Aug 2026 00:30:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /checkout.php. Performing a manipulation of the argument amount_1 results in cross site scripting. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.
Title code-projects Online Shopping System checkout.php cross site scripting
First Time appeared Code-projects
Code-projects online Shopping System
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:code-projects:online_shopping_system:*:*:*:*:*:*:*:*
Vendors & Products Code-projects
Code-projects online Shopping System
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Online Shopping System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-17T15:46:49.981Z

Reserved: 2026-08-15T05:21:55.771Z

Link: CVE-2026-19922

cve-icon Vulnrichment

Updated: 2026-08-17T15:46:45.793Z

cve-icon NVD

Status : Deferred

Published: 2026-08-16T01:17:07.840

Modified: 2026-08-20T12:48:10.287

Link: CVE-2026-19922

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-16T10:30:04Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')