Is there a public PoC exploit available for CVE-2026-14656?

Yes, a public proof-of-concept exploit is available for CVE-2026-14656. Prioritise patching immediately. EPSS: 0.4%.

Assessment Management CVE-2026-14656

Q: What is the CVSS score of CVE-2026-14656?

CVE-2026-14656 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-41700 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-07-04 VulDB

GHSA-v4rr-72fr-6w7j

PHP XSS Assessment Management Code Projects

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Reflected XSS delivered over network with no attacker privileges; scope changes as injected script executes in victim browser context, yielding client-side confidentiality and integrity impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Jul 04, 2026 - 22:22 NVD

MEDIUM LOW

CVSS changed

Jul 04, 2026 - 22:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jul 04, 2026 - 22:21 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in code-projects Assessment Management 1.0. This affects an unknown part of the file /admin/remove-user.php. The manipulation of the argument ID leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

Cross-site scripting in code-projects Assessment Management 1.0 allows remote unauthenticated attackers to inject malicious scripts via the unsanitized ID parameter in /admin/remove-user.php. A public proof-of-concept exploit is available on GitHub (E:P in the CVSS 4.0 supplemental metrics), lowering the bar for exploitation. The vulnerability is not listed in the CISA KEV catalog, so confirmed widespread active exploitation has not been established, though the admin-facing endpoint makes session hijacking of privileged users a realistic outcome.

Technical ContextAI

The affected product is a PHP-based assessment management web application developed by code-projects, identified by CPE cpe:2.3:a:code-projects:assessment_management:*:*:*:*:*:*:*:*. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting): the ID parameter submitted to /admin/remove-user.php is reflected into the HTTP response without proper sanitization or output encoding. Because the vulnerable endpoint resides under the /admin/ path, successful exploitation typically requires an authenticated administrator to be the victim. The application is written in PHP and the vulnerability follows a classic reflected XSS pattern common in unvalidated query-parameter handling.

RemediationAI

No vendor-released patch has been identified at time of analysis. Developers should immediately apply output encoding (e.g., PHP htmlspecialchars()) to the ID parameter before reflecting it into the HTML response in /admin/remove-user.php, and validate that it matches an expected integer format server-side. As a compensating control, restrict access to the /admin/ directory via web server IP allowlisting or HTTP authentication middleware - note this may impact legitimate remote administration workflows. Deploying a Web Application Firewall with a rule blocking common XSS payloads in the ID parameter provides an additional layer but should not substitute for source-level fixes. The public POC at https://github.com/zzzxc643/CVE1/blob/main/assessment/vul4.md can be used to verify whether a fix is effective. Monitor for anomalous admin session activity in the interim.