Is there a public PoC exploit available for CVE-2026-14705?

Yes, a public proof-of-concept exploit is available for CVE-2026-14705. Prioritise patching immediately. EPSS: 0.3%.

Online Examination CVE-2026-14705

Q: What is the CVSS score of CVE-2026-14705?

CVE-2026-14705 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41726 MEDIUM

SQL Injection (CWE-89)

2026-07-05 VulDB

GHSA-rcfx-cxxj-hrf2

PHP SQLi Online Examination Code Projects

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.6 HIGH

Login-form SQL injection requires no credentials (PR:N, AV:N); full database read is realistic (C:H), while write and availability impacts are limited.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 06:24 vuln.today

CVSS changed

Jul 05, 2026 - 06:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability was determined in code-projects Online Examination 1.0. Affected by this issue is some unknown functionality of the file head.php. Executing a manipulation of the argument uname/password can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

SQL injection in code-projects Online Examination 1.0 exposes the login endpoint to unauthenticated remote attackers via the uname and password parameters in head.php. Manipulation of either parameter enables classic SQL injection, allowing database enumeration, authentication bypass, and potential data manipulation against any deployed instance. A public proof-of-concept exploit is available on GitHub (no public exploit identified as KEV), making weaponization trivial for low-skill attackers targeting this application.

Technical ContextAI

The affected product is a PHP-based online examination web application distributed by code-projects.org, identified by CPE cpe:2.3:a:code-projects:online_examination:*:*:*:*:*:*:*:*. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), a classic SQL injection arising from unsanitized user-supplied input in the uname and password fields being concatenated directly into SQL queries within head.php - a file that handles authentication logic. The absence of parameterized queries or prepared statements in the PHP code path allows an attacker to inject arbitrary SQL syntax, manipulating the query structure at the database layer. The wildcard CPE (* for version) suggests all distributed versions of this application are affected.

RemediationAI

No vendor-released patch has been identified at time of analysis for code-projects Online Examination 1.0 - the wildcard CPE and absence of a vendor advisory confirm no fixed version is available. The primary remediation is to decommission or replace this application entirely, as code-projects software is distributed as educational/demo code not intended for production deployment. If continued operation is required, developers must refactor head.php to use PHP PDO or MySQLi prepared statements with parameterized queries for the uname and password inputs, eliminating the injection surface. As a compensating control, deploying a Web Application Firewall (WAF) with SQL injection detection rules in front of the application can reduce exploitation success but does not eliminate the root cause and may be bypassed with encoding techniques. Restricting access to the login endpoint (head.php) to trusted IP ranges via server-level ACLs (Apache .htaccess or nginx allow/deny directives) meaningfully limits attack surface at the cost of access flexibility. The exploit PoC is documented at https://github.com/zzzxc643/CVE1/blob/main/project1/vul1.md and the VulDB advisory is at https://vuldb.com/vuln/376301.