EIP-2026-111007

The provided text describes a cross-site scripting (XSS) vulnerability in PHPCart 3.1.2, where the 'order_id' parameter in the admin/search.php endpoint is not properly sanitized. This allows an attacker to inject arbitrary script code, potentially leading to session hijacking or other client-side attacks.