Is there a public PoC exploit available for CVE-2026-14658?

Yes, a public proof-of-concept exploit is available for CVE-2026-14658. Prioritise patching immediately. EPSS: 0.3%.

Assessment Management CVE-2026-14658

Q: What is the CVSS score of CVE-2026-14658?

CVE-2026-14658 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41702 LOW

SQL Injection (CWE-89)

2026-07-04 VulDB

GHSA-jv67-v44p-6vhx

PHP SQLi Assessment Management Code Projects

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable SQLi requiring low-privilege authentication; partial CIA impact reflecting application-level data read/write without system-level scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 04, 2026 - 23:22 NVD

MEDIUM LOW

CVSS changed

Jul 04, 2026 - 23:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jul 04, 2026 - 22:51 vuln.today

DescriptionCVE.org

A vulnerability was detected in code-projects Assessment Management 1.0. This vulnerability affects unknown code of the file /lecturer/marking-scheme.php. The manipulation of the argument smarksrange[] results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used.

AnalysisAI

SQL injection in code-projects Assessment Management 1.0 allows authenticated remote attackers to execute arbitrary SQL queries by manipulating the smarksrange[] array parameter in /lecturer/marking-scheme.php. The CVSS 4.0 vector (PR:L) confirms low-privilege authentication is required, limiting the attack surface to registered users such as lecturers. A public exploit proof-of-concept is available on GitHub, elevating the practical risk despite the medium CVSS 4.0 score of 5.3 and no confirmed active exploitation in the CISA KEV catalog.

Technical ContextAI

The vulnerability is rooted in CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), a classic SQL injection class. The affected application is a PHP-based academic assessment platform (CPE: cpe:2.3:a:code-projects:assessment_management:*:*:*:*:*:*:*:*) developed by code-projects.org, which distributes PHP demo/educational projects. The vulnerable endpoint /lecturer/marking-scheme.php accepts an array parameter smarksrange[] - a common PHP pattern for multi-value form inputs - and passes user-supplied values directly into SQL queries without parameterization or sanitization. PHP array parameters are particularly prone to this because developers sometimes assume array inputs imply structured/safe data, while SQL concatenation on array elements remains equally dangerous.

RemediationAI

No vendor-released patch has been identified at time of analysis; code-projects.org has not published a security advisory. The primary remediation is to replace direct SQL string concatenation in /lecturer/marking-scheme.php with parameterized queries or prepared statements using PHP's PDO or MySQLi extensions - this eliminates the injection vector at the root cause. As a compensating control, administrators can restrict access to the /lecturer/ path to known IP ranges or internal networks via web server ACLs (e.g., Apache .htaccess or nginx allow/deny directives), which reduces remote exploitability at the cost of restricting legitimate remote access. Input validation enforcing that all smarksrange[] values are strictly numeric can also mitigate the issue without code restructuring, though this is a defense-in-depth measure rather than a complete fix. Deploying a web application firewall (WAF) with SQL injection rulesets (e.g., ModSecurity with the OWASP Core Rule Set) can detect and block exploitation attempts in transit. VulDB tracking is available at https://vuldb.com/vuln/376171.