The vulnerability resides in the save_user function of the /admin/ajax.php?action=save_user endpoint in SourceCodester Pizzafy Ecommerce System 1.0. By manipulating the Name parameter an attacker can inject arbitrary script code, enabling cross‑site scripting that can be executed remotely from a browser. This flaw permits the attacker to run forged JavaScript in the victim’s context, potentially exfiltrating data or performing actions on the victim’s behalf.

Systems running SourceCodester Pizzafy Ecommerce System version 1.0 and exposing the /admin/ajax.php?action=save_user endpoint are susceptible. The issue is confined to the handling of the Name field in the save_user function.

The CVSS score of 4.8 indicates moderate severity. No EPSS information is available, and the vulnerability is not listed in CISA’s KEV catalog. It is exploitable remotely via an HTTP request that supplies a malicious Name value; since the flaw is publicly disclosed, attackers could already be exploiting it. The overall risk level is medium because the vulnerability relies on user input and requires the victim to load the affected page.