CVE-2026-82700: code-projects Online Shopping System Newsletter Subscription offersmail.php cross site scripting
A vulnerability was found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /offersmail.php of the component Newsletter Subscription. The manipulation of the argument email results in cross site scripting. The attack may be performed from remote. The exploit has been made public and could be used.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Instances of code-projects Online Shopping System 1.0 that expose the Newsletter Subscription functionality through /offersmail.php are affected. The attack can be performed remotely and does not require prior privileges.
What must an attacker do to exploit it?
An attacker must manipulate the email argument handled by /offersmail.php. Successful exploitation also requires user interaction, consistent with the UI:R vector.
Is exploitation likely to be practical?
A public exploit has been disclosed and could be used. The reported attack complexity is low.