# CVE-2026-79793: code-projects Online Shopping System reflected XSS in admin form

Source: https://junglewise.ai/threats/cve-2026-79793-code-projects-online-shopping-system-reflected-xss-in-admin-form  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-79793 · Severity: medium · CVSS 4.3 · Published 2026-08-25

Online Shopping System is a PHP-based e-commerce platform used to manage online stores. A reflected cross-site scripting (XSS) vulnerability in the admin panel allows an attacker to inject malicious code that executes in an administrator's browser, potentially leading to session hijacking, credential theft, and unauthorized administrative actions.

Technologies: [Code-Projects Online Shopping System](https://junglewise.ai/threats/technologies/online-shopping-system). Vendors: [Code-Projects](https://junglewise.ai/threats/vendors/code-projects).

## Quick answers

**Is CVE-2026-79793 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-79793 being exploited in the wild.

**How severe is CVE-2026-79793?** Medium severity, with a CVSS score of 4.3, published 25 August 2026.

**Which products and versions are affected?** Code-Projects Online Shopping System 1.0.

**Is there a fix for CVE-2026-79793?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-79793 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-79793?** Check whether you run Code-Projects Online Shopping System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a reflected XSS flaw in /admin/sumit_form.php where the "success" parameter (accessible via GET/POST) is directly output into an HTML input element's value attribute without sanitization or encoding. The vulnerable code retrieves $_REQUEST['success'] and echoes it into the page without any HTML entity encoding or input validation. An attacker can craft a URL containing a payload like "><script>alert(888)</script> which breaks out of the attribute context and executes arbitrary JavaScript in the victim's browser. The attack requires the victim (typically an admin) to click a malicious link; no authentication bypass is needed for the XSS itself, though admin access increases impact. A patch should implement output encoding (e.g., htmlspecialchars) or input validation on the success parameter.

## Affected products

- code-projects Online Shopping System 1.0

## Timeline

- 2026-08-25: disclosed
- other: Exploit PoC publicly available on GitHub

## References

- [https://code-projects.org/](https://code-projects.org/)
- [https://github.com/zzzxc643/CVE1/blob/main/online-shopping-system/vul7.md](https://github.com/zzzxc643/CVE1/blob/main/online-shopping-system/vul7.md)

## Related threats

- [code-projects Online Shopping System SQL injection in admin adduser](https://junglewise.ai/threats/cve-2026-85643-code-projects-online-shopping-system-sql-injection-in-admin)
- [code-projects Online Shopping System SQL injection in search](https://junglewise.ai/threats/cve-2026-82701-code-projects-online-shopping-system-sql-injection-in-search)
- [code-projects Online Shopping System cross-site scripting in newsletter](https://junglewise.ai/threats/cve-2026-82700-code-projects-online-shopping-system-cross-site-scripting-in)