CVE-2026-9377
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A cross-site scripting vulnerability was found in SUP Online Shopping version 1.0 in the file /admin/productedit.php. Manipulation of the productName argument allows remote script injection. The exploit is publicly available.
Risk Assessment
An attacker can remotely execute malicious scripts in the administrator's browser, potentially leading to theft of customer data or administrative session hijacking.
Recommendation
Immediately update the system to the latest version or apply a patch that prevents XSS (e.g., input validation and output encoding).
Original NVD description (English source)
A vulnerability was identified in SourceCodester SUP Online Shopping 1.0. The impacted element is an unknown function of the file /admin/productedit.php. The manipulation of the argument productName leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.