The vulnerability occurs in the save_settings function of SourceCodester Pizzafy Ecommerce System’s administrative page. By manipulating the Name argument, an attacker can inject arbitrary JavaScript that is reflected to the browser, enabling cross‑site scripting. The consequence is that a malicious user can execute code within the context of the victim’s session, potentially stealing cookies, hijacking sessions, defacing content, or deflecting traffic. The weakness is classified as CWE‑79 and also involves potential code injection as per CWE‑94.

This issue affects the 1.0 release of the SourceCodester Pizzafy Ecommerce System. Any instance running this version, or earlier releases that have not applied the fix, is susceptible. The vendor is SourceCodester and the affected component is the admin index page handling save_settings.

The CVSS score of 4.8 indicates a moderate threat level. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack can be launched remotely and an exploit has already been published, meaning the risk of real‑world exploitation is present. Attackers do not need privileged access to the system; simply directing a malicious request to /admin/index.php?page=save_settings with a crafted Name value will trigger the flaw.