Is there a public PoC exploit available for CVE-2026-14655?

Yes, a public proof-of-concept exploit is available for CVE-2026-14655. Prioritise patching immediately. EPSS: 0.3%.

Assessment Management CVE-2026-14655

Q: What is the CVSS score of CVE-2026-14655?

CVE-2026-14655 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41699 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-07-04 VulDB

GHSA-fw3x-5893-39mv

PHP XSS Assessment Management Code Projects

1.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.8 MEDIUM

Admin auth (PR:H) and victim page load (UI:R) required; scope change applies as XSS executes in victim browser context with low C and I impact.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 04, 2026 - 22:22 vuln.today

Severity Changed

Jul 04, 2026 - 22:22 NVD

MEDIUM LOW

CVSS changed

Jul 04, 2026 - 22:22 NVD

4.8 (MEDIUM) 1.9 (LOW)

DescriptionCVE.org

A weakness has been identified in code-projects Assessment Management 1.0. Affected by this issue is some unknown functionality of the file admin/view-users.php. Executing a manipulation of the argument User can lead to cross site scripting. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

Cross-site scripting (XSS) in code-projects Assessment Management 1.0 allows a remote attacker with administrative credentials to inject malicious scripts via the User parameter in admin/view-users.php, executing arbitrary JavaScript in the browser context of users who view the affected admin page. The CVSS 4.0 vector (PR:H, UI:P) confirms exploitation is gated behind high-privilege authentication and requires a victim to load the tampered page. A public proof-of-concept exploit exists on GitHub, though no active exploitation or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

The affected application is a PHP-based web assessment management system distributed by code-projects.org. The CWE-79 root cause is improper neutralization of user-supplied input in the HTML generation path - specifically, the 'User' argument passed to admin/view-users.php is rendered in the browser response without adequate sanitization or output encoding. This allows injection of HTML/JavaScript content into the admin panel. The CPE string cpe:2.3:a:code-projects:assessment_management:*:*:*:*:*:*:*:* uses a wildcard version component, indicating NVD/VulDB have not confirmed a specific clean version - all known releases of the product should be treated as affected. The attack is consistent with a stored or reflected XSS pattern in a server-side PHP rendering flow.

RemediationAI

No vendor-released patch has been identified at time of analysis - patch availability is unknown and no fixed version number is confirmed in the available data. As a compensating control, access to the admin panel (including admin/view-users.php) should be restricted to trusted internal network ranges or VPN-only access, preventing remote exploitation even by authenticated users. Deploying a Content Security Policy (CSP) header with a strict script-src directive will significantly reduce the impact of any XSS payload by blocking inline script execution. At the code level, the User parameter in admin/view-users.php should be sanitized using PHP's htmlspecialchars() with ENT_QUOTES before rendering in HTML context. The public PoC at https://github.com/zzzxc643/CVE1/blob/main/assessment/vul3.md can be used to verify whether a patched or hardened instance is no longer vulnerable. Monitor VulDB entry https://vuldb.com/vuln/376169 for patch release updates.