CVE-2026-5647

LowCVSS 2.4/10Last modified Jun 17, 2026

Description

A vulnerability was detected in code-projects Online Shoe Store 1.0. This affects an unknown part of the file /admin/admin_feature.php of the component Add Product Page. The manipulation of the argument product_name results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used.

Metrics

CVSS 3.1 2.4/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Apr 6, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-56487.3A flaw has been found in code-projects Simple Laundry System 1.0. This vulnerability affects unknown code of the file /userfinishregister.phCVE-2026-56496.3A vulnerability has been found in code-projects Online Application System for Admission 1.0. This issue affects some unknown processing of tCVE-2026-56505.3A vulnerability was found in code-projects Online Application System for Admission 1.0. Impacted is an unknown function of the file /enrollmCVE-2026-56514.9The Askeet plugin for WordPress is vulnerable to SQL Injection via the 'sql_query' parameter in multiple AJAX actions (askeet_execute_sql_quCVE-2026-56529.0An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker toCVE-2026-56537.5DCP-ETSI protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of serviceCVE-2026-565373.5HCL Connections is vulnerable to information disclosure which could allow a user to obtain sensitive information they are not entitled to, cCVE-2026-565383.5An endpoint in HCL Connections is vulnerable to information disclosure. In certain scenarios this might lead to disclosing sensitive informaCVE-2026-56547.5AMR-NB codec crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of serviceCVE-2026-565473.5The Apple profile generated for the Apple built-in Mail, Calendar and Contacts account to synchronize with HCL Traveler requires the Logon NCVE-2026-56557.5SDP protocol dissector crash in Wireshark 4.6.0 to 4.6.4 allows denial of serviceCVE-2026-56567.8Profile import path traversal in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service and possible code execution
CVE-2026-5647: Low severity, CVSS 2.4 | Vulnix