# CVE-2026-5835: code-projects Online Shoe Store XSS in admin_football.php

Source: https://junglewise.ai/threats/cve-2026-5835-code-projects-online-shoe-store-xss-in-admin-football-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-09. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-5835 · Severity: low · CVSS 2.4 · Published 2026-04-09

Online Shoe Store is a web application used for managing an e-commerce storefront. A security flaw in the administrative interface allows an attacker to inject malicious scripts into the product management pages. If an administrator views the affected page, the attacker could potentially perform unauthorized actions or steal session information, though the exploit requires administrative access to initiate.

Technologies: [Code-Projects Online Shoe Store](https://junglewise.ai/threats/technologies/online-shoe-store). Vendors: [Code-Projects](https://junglewise.ai/threats/vendors/code-projects).

## Quick answers

**Is CVE-2026-5835 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5835 being exploited in the wild.

**How severe is CVE-2026-5835?** Low severity, with a CVSS score of 2.4, published 9 April 2026.

**Which products and versions are affected?** Code-Projects Online Shoe Store 1.0.

**Is there a fix for CVE-2026-5835?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-5835 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-5835?** Check whether you run Code-Projects Online Shoe Store at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in the Online Shoe Store 1.0 project by code-projects. The flaw is located in the '/admin/admin_football.php' component due to insufficient sanitization of the 'product_name' parameter. An attacker can exploit this by submitting a malicious payload (e.g., <script>prompt(/xss/);</script>) which is then executed in the browser of any user viewing the administrative product list. While the CVSS metrics suggest high privileges are required, the researcher notes that the specific endpoint may be accessible without authorization in some configurations. A proof-of-concept exploit has been publicly disclosed.

## Affected products

- code-projects Online Shoe Store 1.0

## Timeline

- 2026-03-25: disclosed: Vulnerability details and PoC shared on GitHub.
- 2026-04-09: advisory: CVE-2026-5835 published.

## References

- [https://code-projects.org/](https://code-projects.org/)
- [https://github.com/lonelyuan/vunls/issues/4](https://github.com/lonelyuan/vunls/issues/4)
- [https://vuldb.com/submit/788340](https://vuldb.com/submit/788340)
- [https://vuldb.com/vuln/356291](https://vuldb.com/vuln/356291)
- [https://vuldb.com/vuln/356291/cti](https://vuldb.com/vuln/356291/cti)

## Related threats

- [code-projects Online Shoe Store cross-site scripting in admin_product.php](https://junglewise.ai/threats/cve-2026-5836-code-projects-online-shoe-store-cross-site-scripting-in-admin)
- [code-projects Online Shoe Store XSS in admin_running.php](https://junglewise.ai/threats/cve-2026-5834-code-projects-online-shoe-store-xss-in-admin-running-php)